AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 18, 2026
CVE-2026-1263: Webling <= 3.9.0 Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1263 in Webling (CVSS 6.4): Webling. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.1.
April 18, 2026
CVE-2026-4977: UsersWP <= 1.2.58 Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4977 in Userswp (CVSS 4.3): UsersWP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.59.
April 18, 2026
CVE-2026-6443: Accordion and Accordion Slider 1.4.6 Injected Backdoor PoC, Patch Analysis & Rule
Critical CVE-2026-6443 in Accordion And Accordion Slider (CVSS 9.8): Accordion and Accordion Slider 1.4.6 - Injected Backdoor. Atomic Edge summarizes impact, exploitability, and patch details.
April 18, 2026
CVE-2026-2305: AddFunc Head & Footer Code <= 2.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields PoC, Patch Analysis & Rule
Medium CVE-2026-2305 in Addfunc Head Footer Code (CVSS 6.4): AddFunc Head & Footer Code. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.
April 18, 2026
CVE-2026-4057: Download Manager <= 3.3.51 Missing Authorization to Authenticated (Contributor+) Media File Protection Removal PoC, Patch Analysis & Rule
Medium CVE-2026-4057 in Download Manager (CVSS 4.3): Download Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.3.52.
April 18, 2026
CVE-2026-5742: UsersWP <= 1.2.60 Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution PoC, Patch Analysis & Rule
Medium CVE-2026-5742 in Userswp (CVSS 6.4): UsersWP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.61.
April 18, 2026
CVE-2026-4351: Perfmatters <= 2.5.9 Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4351 in Perfmatters (CVSS 8.1): Perfmatters. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 18, 2026
CVE-2026-5436: MW WP Form <= 5.1.1 Unauthenticated Arbitrary File Move via regenerate_upload_file_keys PoC, Patch Analysis & Rule
High CVE-2026-5436 in Mw Wp Form (CVSS 8.1): MW WP Form. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.1.2.
April 18, 2026
CVE-2026-1830: Quick Playground <= 1.3.1 Missing Authorization to Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2026-1830 in Quick Playground (CVSS 9.8): Quick Playground. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.2.
April 18, 2026
CVE-2026-5357: Download Manager <= 3.3.52 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-5357 in Download Manager (CVSS 6.4): Download Manager. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.3.53.
April 18, 2026
CVE-2026-4336: Ultimate FAQ Accordion Plugin <= 2.4.7 Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content PoC, Patch Analysis & Rule
Medium CVE-2026-4336 in Ultimate Faqs (CVSS 6.4): Ultimate FAQ Accordion Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.8.
April 18, 2026
CVE-2026-5711: Post Blocks & Tools <= 1.3.0 Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-5711 in Bnm Blocks (CVSS 6.4): Post Blocks & Tools. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.1.
April 18, 2026
CVE-2026-2712: WP-Optimize <= 4.5.0 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation PoC, Patch Analysis & Rule
Medium CVE-2026-2712 in Wp Optimize (CVSS 5.4): WP-Optimize. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.5.1.
April 17, 2026
CVE-2026-5207: LifterLMS <= 9.2.1 Authenticated (Custom+) SQL Injection via 'order' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5207 in Lifterlms (CVSS 6.5): LifterLMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 9.2.2.
April 17, 2026
CVE-2026-3371: Tutor LMS <= 3.9.7 Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification PoC, Patch Analysis & Rule
Medium CVE-2026-3371 in Tutor (CVSS 4.3): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.9.8.
April 17, 2026
CVE-2026-4979: UsersWP <= 1.2.58 Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4979 in Userswp (CVSS 5.0): UsersWP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.59.
April 17, 2026
CVE-2026-5144: BuddyPress Groupblog <= 1.9.3 Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR PoC, Patch Analysis & Rule
High CVE-2026-5144 in Bp Groupblog (CVSS 8.8): BuddyPress Groupblog. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.9.4.
April 17, 2026
CVE-2026-3498: BlockArt Blocks <= 2.2.15 Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-3498 in Blockart Blocks (CVSS 6.4): BlockArt Blocks. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.3.0.
April 17, 2026
CVE-2026-4895: Greenshift <= 12.8.9 Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4895 in Greenshift Animation And Page Builder Blocks (CVSS 6.4): Greenshift. Atomic Edge summarizes impact, exploitability, and patch details. Update to 12.9.0.
April 17, 2026
CVE-2026-3358: Tutor LMS <= 3.9.7 Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment PoC, Patch Analysis & Rule
Medium CVE-2026-3358 in Tutor (CVSS 5.4): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.8.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.