AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2026-4314: The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module PoC, Patch Analysis & Rule
High CVE-2026-4314 in Wpextended (CVSS 8.8): The Ultimate WordPress Toolkit – WP Extended. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.2.5.
March 23, 2026
CVE-2026-2580: WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 Unauthenticated SQL Injection via 'orderby' Parameter PoC, Patch Analysis & Rule
High CVE-2026-2580 in Wp Google Map Plugin (CVSS 7.5): WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
March 23, 2026
CVE-2026-3629: Import and export users and customers <= 1.29.7 Privilege Escalation to Administrator via save_extra_user_profile_fields PoC, Patch Analysis & Rule
High CVE-2026-3629 in Import Users From Csv With Meta (CVSS 8.1): Import and export users and customers. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.
March 23, 2026
CVE-2025-14037: Invelity Products Feeds <= 1.2.6 Cross-Site Request Forgery to Arbitrary File Deletion PoC, Patch Analysis & Rule
High CVE-2025-14037 in Invelity Products Feeds (CVSS 8.1): Invelity Products Feeds. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2024-13785: Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 Unauthenticated Blind Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
Medium CVE-2024-13785 in Arforms Form Builder (CVSS 5.6): Contact Form, Survey, Quiz & Popup Form Builder – ARForms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2025-13997: King Addons for Elementor <= 51.1.49 Unauthenticated API Keys Disclosure PoC, Patch Analysis & Rule
Medium CVE-2025-13997 in King Addons (CVSS 5.3): King Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 51.1.51.
March 18, 2026
CVE-2026-0739: WMF Mobile Redirector <= 1.2 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-0739 in Wmf Mobile Redirector (CVSS 4.4): WMF Mobile Redirector. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0812: LinkedIn SC <= 1.1.9 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page PoC, Patch Analysis & Rule
Medium CVE-2026-0812 in Linkedin Sc (CVSS 4.4): LinkedIn SC. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14846: SocialChamp with WordPress <= 1.3.5 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14846 in Auto Post To Social Media Wp To Social Champ (CVSS 4.3): SocialChamp with WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.6.
March 18, 2026
CVE-2026-0594: List Site Contributors <= 1.1.8 Reflected Cross-Site Scripting via alpha PoC, Patch Analysis & Rule
Medium CVE-2026-0594 in List Site Contributors (CVSS 6.1): List Site Contributors. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0741: Electric Studio Download Counter <= 2.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-0741 in Electric Studio Download Counter (CVSS 4.4): Electric Studio Download Counter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15377: Sosh Share Buttons <= 1.1.0 Cross-Site Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2025-15377 in Sosh Share Buttons (CVSS 4.3): Sosh Share Buttons. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15378: AJS Footnotes <= 1.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2025-15378 in Ajs Footnotes (CVSS 7.2): AJS Footnotes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14502: News and Blog Designer Bundle <= 1.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
Critical CVE-2025-14502 in News And Blog Designer Bundle (CVSS 9.8): News and Blog Designer Bundle. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14301: Integration Opvius AI for WooCommerce <= 1.3.0 Unauthenticated Arbitrary File Deletion/Read via Path Traversal PoC, Patch Analysis & Rule
Critical CVE-2025-14301 in Woosa Ai For Woocommerce (CVSS 9.8): Integration Opvius AI for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14615: DASHBOARD BUILDER <= 1.5.7 Cross-Site Request Forgery to SQL Injection PoC, Patch Analysis & Rule
High CVE-2025-14615 in Dashboard Builder (CVSS 7.1): DASHBOARD BUILDER. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15283: Name Directory <= 1.30.3 Unauthenticated Stored Cross-Site Scripting via Multiple Parameters PoC, Patch Analysis & Rule
High CVE-2025-15283 in Name Directory (CVSS 7.2): Name Directory. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.31.0.
March 18, 2026
CVE-2025-15266: GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2025-15266 in Geeky Bot (CVSS 7.2): GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.9.
March 18, 2026
CVE-2025-15020: Gotham Block Extra Light <= 1.5.0 Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-15020 in Gotham Block Extra Light (CVSS 6.5): Gotham Block Extra Light. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14880: Netcash WooCommerce Payment Gateway <= 4.1.3 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
Medium CVE-2025-14880 in Netcash Pay Now Payment Gateway For Woocommerce (CVSS 5.3): Netcash WooCommerce Payment Gateway. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.1.4.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.