AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 17, 2026
CVE-2026-6203: User Registration & Membership <= 5.1.4 Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6203 in User Registration (CVSS 6.1): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.1.5.
April 17, 2026
CVE-2026-5217: Optimole <= 4.2.2 Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter PoC, Patch Analysis & Rule
High CVE-2026-5217 in Optimole Wp (CVSS 7.2): Optimole. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.2.3.
April 17, 2026
CVE-2026-5809: wpForo Forum <= 3.0.2 Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5809 in Wpforo (CVSS 7.1): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.3.
April 17, 2026
CVE-2024-12118: The Events Calendar <= 6.9.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2024-12118 in The Events Calendar (CVSS 6.4): The Events Calendar. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.9.1.
April 17, 2026
CVE-2026-5427: Kubio AI Page Builder <= 2.7.2 Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-5427 in Kubio (CVSS 5.3): Kubio AI Page Builder. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.7.3.
April 17, 2026
CVE-2026-4853: JetBackup <= 3.1.19.8 Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4853 in Backup (CVSS 4.9): JetBackup. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.20.3.
April 17, 2026
CVE-2026-4666: wpForo Forum <= 2.4.16 Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4666 in Wpforo (CVSS 6.5): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.0.
April 17, 2026
CVE-2026-3330: Form Maker by 10Web <= 1.15.40 Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3330 in Form Maker (CVSS 4.9): Form Maker by 10Web. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.15.41.
April 17, 2026
CVE-2026-4659: Unlimited Elements For Elementor <= 2.0.6 Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal PoC, Patch Analysis & Rule
High CVE-2026-4659 in Unlimited Elements For Elementor (CVSS 7.5): Unlimited Elements For Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 17, 2026
CVE-2026-5502: Tutor LMS <= 3.9.8 Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order PoC, Patch Analysis & Rule
Medium CVE-2026-5502 in Tutor (CVSS 5.3): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.9.9.
April 17, 2026
CVE-2026-5797: Quiz and Survey Master (QSM) <= 11.1.0 Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields PoC, Patch Analysis & Rule
Medium CVE-2026-5797 in Quiz Master Next (CVSS 5.3): Quiz and Survey Master (QSM). Atomic Edge summarizes impact, exploitability, and patch details. Update to 11.1.1.
April 17, 2026
CVE-2026-6080: Tutor LMS <= 3.9.8 Authenticated (Admin+) SQL Injection via 'date' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6080 in Tutor (CVSS 6.5): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.9.
April 17, 2026
CVE-2026-5231: WP Statistics <= 14.16.4 Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5231 in Wp Statistics (CVSS 7.2): WP Statistics. Atomic Edge summarizes impact, exploitability, and patch details. Update to 14.16.5.
April 17, 2026
CVE-2026-5162: Royal Addons for Elementor <= 1.7.1056 Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget PoC, Patch Analysis & Rule
Medium CVE-2026-5162 in Royal Elementor Addons (CVSS 6.4): Royal Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.7.1057.
April 17, 2026
CVE-2026-4352: JetEngine <= 3.8.6.1 Unauthenticated SQL Injection via '_cct_search' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4352 in Jet Engine (CVSS 7.5): JetEngine. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 17, 2026
CVE-2026-6451: CMS für Motorrad Werkstätten <= 1.0.0 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-6451 affects the Cms Fuer Motorrad Werkstaetten plugin (v1.0.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Unauthenticated attackers can delete data by tricking logged-in users. Update to the patched version for...
April 17, 2026
CVE-2026-6439: VideoZen <= 1.0.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field PoC, Patch Analysis & Rule
CVE-2026-6439 affects the VideoZen plugin for WordPress (v1.0.1) with a medium severity (CVSS 4.4) stored XSS vulnerability. Administrators should patch or mitigate to prevent script injection risks.
April 17, 2026
CVE-2026-5234: LatePoint <= 5.3.2 Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID PoC, Patch Analysis & Rule
Medium CVE-2026-5234 in Latepoint (CVSS 5.3): LatePoint. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.0.
April 17, 2026
CVE-2026-3488: WP Statistics <= 14.16.4 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation PoC, Patch Analysis & Rule
Medium CVE-2026-3488 in Wp Statistics (CVSS 6.5): WP Statistics. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 14.16.5.
April 17, 2026
CVE-2026-4817: MasterStudy LMS <= 3.7.25 Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-4817 in Masterstudy Lms Learning Management System (CVSS 6.5): MasterStudy LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.7.26.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.