AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
July 4, 2026
CVE-2026-57661: WPComplete <= 2.9.5.5 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-57661 in Wpcomplete (CVSS 4.3): WPComplete. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.9.5.6.
July 4, 2026
CVE-2026-57324: GIFT4U – Gift Cards All in One for Woo <= 1.0.10 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-57324 in Gift4u Gift Cards All In One For Woo (CVSS 5.3): GIFT4U – Gift Cards All in One for Woo. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 3, 2026
CVE-2026-11778: CURCY <= 2.2.14 Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-11778 in Woo Multi Currency (CVSS 5.4): CURCY. Atomic Edge summarizes impact, exploitability, and patch details.
July 3, 2026
CVE-2026-7311: TinyPNG <= 3.6.13 Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta PoC, Patch Analysis & Rule
High CVE-2026-7311 in Tiny Compress Images (CVSS 8.1): TinyPNG. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.6.14.
July 3, 2026
CVE-2026-9834: WP Database Backup <= 7.11 Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter PoC, Patch Analysis & Rule
High CVE-2026-9834 in Wp Database Backup (CVSS 7.2): WP Database Backup. Atomic Edge summarizes impact, exploitability, and patch details. Update to 7.12.
July 3, 2026
CVE-2026-9180: MotoPress Appointment Booking <= 2.4.4 Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-9180 in Motopress Appointment Lite (CVSS 5.3): MotoPress Appointment Booking. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.5.
July 3, 2026
CVE-2026-9756: GenerateBlocks <= 2.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-9756 in Generateblocks (CVSS 6.4): GenerateBlocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.3.0.
July 3, 2026
CVE-2026-11600: Envo’s Templates & Widgets for Elementor and WooCommerce <= 1.4.26 Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting PoC, Patch Analysis & Rule
Medium CVE-2026-11600 in Envo Elementor For Woocommerce (CVSS 4.3): Envo's Templates & Widgets for Elementor and WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.4.27.
July 3, 2026
CVE-2026-11380: JetWidgets For Elementor <= 1.0.21 Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting PoC, Patch Analysis & Rule
Medium CVE-2026-11380 in Jetwidgets For Elementor (CVSS 6.4): JetWidgets For Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.0.22.
July 3, 2026
CVE-2026-12110: Taskbuilder <= 5.0.8 Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-12110 in Taskbuilder (CVSS 6.5): Taskbuilder. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.0.9.
July 3, 2026
CVE-2026-7517: Custom Payment Gateways for WooCommerce <= 2.1.0 Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter PoC, Patch Analysis & Rule
High CVE-2026-7517 in Custom Payment Gateways Woocommerce (CVSS 7.2): Custom Payment Gateways for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.2.0.
July 3, 2026
CVE-2026-12090: Taskbuilder <= 5.0.8 Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-12090 in Taskbuilder (CVSS 6.5): Taskbuilder. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.0.9.
July 3, 2026
CVE-2026-5524: Divi Form Builder <= 5.1.8 Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter PoC, Patch Analysis & Rule
Critical CVE-2026-5524 in Divi Form Builder (CVSS 9.8): Divi Form Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 3, 2026
CVE-2026-2387: Event Organiser <= 3.12.9 Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-2387 in Event Organiser (CVSS 6.4): Event Organiser. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.12.10.
July 3, 2026
CVE-2026-13015: WP Google Review Slider <= 18.1 Reflected Cross-Site Scripting via 'place' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-13015 in Wp Google Places Review Slider (CVSS 6.1): WP Google Review Slider. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 18.2.
July 3, 2026
CVE-2026-13731: WPBot <= 8.4.9 Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter PoC, Patch Analysis & Rule
High CVE-2026-13731 in Chatbot (CVSS 7.2): WPBot. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.5.0.
July 3, 2026
CVE-2026-12135: FV Flowplayer Video Player <= 7.5.51.7212 Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-12135 in Fv Wordpress Flowplayer (CVSS 6.4): FV Flowplayer Video Player. Atomic Edge summarizes impact, exploitability, and patch details.
July 3, 2026
CVE-2026-13468: Visualizer <= 4.0.3 Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint PoC, Patch Analysis & Rule
High CVE-2026-13468 in Visualizer (CVSS 7.5): Visualizer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.0.4.
July 3, 2026
CVE-2026-12923: Video Gallery <= 4.0.3 Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter PoC, Patch Analysis & Rule
High CVE-2026-12923 in Youtube Showcase (CVSS 7.5): Video Gallery. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.0.4.
July 3, 2026
CVE-2026-9107: Kali Forms <= 2.4.13 Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-9107 in Kali Forms (CVSS 6.4): Kali Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.14.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.