AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2026-24605: X Addons for Elementor <= 1.0.23 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24605 in X Addons Elementor (CVSS 4.3): X Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-24601: Penci Pay Writer <= 1.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-24601 in Penci Pay Writer (CVSS 6.4): Penci Pay Writer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-24600: Penci Review <= 3.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-24600 in Penci Review (CVSS 6.4): Penci Review. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2025-15513: Float Payment Gateway <= 1.1.9 Improper Authorization to Unauthenticated Order Status Manipulation PoC, Patch Analysis & Rule
Medium CVE-2025-15513 in Float Gateway (CVSS 5.3): Float Payment Gateway. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.10.
March 23, 2026
CVE-2026-23550: Modular DS <= 2.5.1 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
Critical CVE-2026-23550 in Modular Connector (CVSS 9.8): Modular DS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.5.2.
March 23, 2026
CVE-2026-24606: Bayarcash WooCommerce <= 4.3.12 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24606 in Bayarcash Wc (CVSS 5.3): Bayarcash WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-0734: WP Allowed Hosts <= 1.0.8 Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0734 in Wp Allow Hosts (CVSS 4.4): WP Allowed Hosts. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2025-14770: Shipping Rate By Cities <= 2.0.0 Unauthenticated SQL Injection via 'city' Parameter PoC, Patch Analysis & Rule
High CVE-2025-14770 in Shipping Rate By Cities (CVSS 7.5): Shipping Rate By Cities. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.1.
March 23, 2026
CVE-2025-15376: Stopwords for comments <= 1.1 Missing Authorization to Cross-Site Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2025-15376 in Stopwords For Comments (CVSS 4.3): Stopwords for comments. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2025-15512: Aplazo Payment Gateway <= 1.4.3 Missing Authorization to Unauthenticated Order Status Manipulation PoC, Patch Analysis & Rule
Medium CVE-2025-15512 in Aplazo Payment Gateway (CVSS 5.3): Aplazo Payment Gateway. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.0.
March 23, 2026
CVE-2026-0813: Short Link <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page PoC, Patch Analysis & Rule
Medium CVE-2026-0813 in Short Link (CVSS 4.4): Short Link. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2025-15475: PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
Medium CVE-2025-15475 in Payhere Payment Gateway (CVSS 5.3): PayHere Payment Gateway Plugin for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.0.
March 23, 2026
CVE-2025-14173: Perfit WooCommerce <= 1.0.1 Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-14173 in Perfit Woocommerce (CVSS 5.3): Perfit WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-2421: ilGhera Carta Docente for WooCommerce <= 1.5.0 Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2421 in Wc Carta Docente (CVSS 6.5): ilGhera Carta Docente for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details.
March 23, 2026
CVE-2026-2432: CM Custom Reports <= 1.2.7 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels PoC, Patch Analysis & Rule
Medium CVE-2026-2432 in Cm Custom Reports (CVSS 4.4): CM Custom Reports. Atomic Edge summarizes impact, exploitability, and patch details.
March 23, 2026
CVE-2026-4136: Membership Plugin – Restrict Content <= 3.2.24 Unvalidated Redirect in Password Reset Flow via rcp_redirect PoC, Patch Analysis & Rule
Medium CVE-2026-4136 in Restrict Content (CVSS 4.3): Membership Plugin – Restrict Content. Atomic Edge summarizes impact, exploitability, and patch details.
March 23, 2026
CVE-2025-15363: Get Use APIs – JSON Content Importer < 2.0.10 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-15363 in Json Content Importer (CVSS 6.4): Get Use APIs – JSON Content Importer < 2.0.10 - Authenticated (Contributor+) Stored Cross-Site.... Atomic Edge summarizes impact, exploitability, and patch details.
March 23, 2026
CVE-2026-3658: Appointment Booking Calendar <= 1.6.10.0 Unauthenticated SQL Injection via 'fields' Parameter PoC, Patch Analysis & Rule
High CVE-2026-3658 in Simply Schedule Appointments (CVSS 7.5): Appointment Booking Calendar. Atomic Edge summarizes impact, exploitability, and patch details.
March 23, 2026
CVE-2026-2571: Download Manager <= 3.3.49 Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2571 in Download Manager (CVSS 4.3): Download Manager. Atomic Edge summarizes impact, exploitability, and patch details.
March 23, 2026
CVE-2026-3475: Instant Popup Builder <= 1.1.7 Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3475 in Instant Popup Builder (CVSS 5.3): Instant Popup Builder. Atomic Edge summarizes impact, exploitability, and patch details.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.