Skip to content
Noroxi

Bonds

Patchstack Bug Bounty Program

451 credited records · 320 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers
  • CVE-2026-27347
    21Monitor

    WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    crocoblock · jetpopupSep 4, 2026

  • CVE-2026-66623
    28Monitor

    WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    inisev · social media & share iconsAug 24, 2026

  • CVE-2025-15637
    32Monitor

    WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    edge themes · shuffleAug 20, 2026

  • CVE-2026-66665
    40Plan

    WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0No exploitEPSS 1%

    brandexponents · type hubAug 6, 2026

  • CVE-2026-65579
    39Monitor

    WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    axiomthemes · agricolaAug 6, 2026

  • CVE-2026-65578
    39Monitor

    WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    ancorathemes · agoraAug 6, 2026

  • CVE-2026-65577
    39Monitor

    WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    ancorathemes · adviceAug 6, 2026

  • CVE-2026-65576
    39Monitor

    WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    ancorathemes · adrenaAug 6, 2026

  • CVE-2026-65574
    39Monitor

    WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    ancorathemes · abogadoAug 6, 2026

  • CVE-2026-65572
    39Monitor

    WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    axiomthemes · a.williamsAug 6, 2026

  • CVE-2026-65571
    39Monitor

    WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    axiomthemes · 69 clothingAug 6, 2026

  • CVE-2026-65546
    37Monitor

    WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    qode · qode toursAug 6, 2026

  • CVE-2026-65524
    17Monitor

    WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    themefusion · avada custom brandingJul 23, 2026

  • CVE-2026-57745
    28Monitor

    WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    stmcan · rt-theme 18 | extensionsJul 13, 2026

  • CVE-2026-57744
    39Monitor

    WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    stmcan · rt-theme 18 | extensionsJul 13, 2026

  • CVE-2026-57743
    32Monitor

    WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 1%

    stmcan · rt-theme 18 | extensionsJul 13, 2026

  • CVE-2026-57738
    39Monitor

    WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    axiomthemes · 777Jul 13, 2026

  • CVE-2026-57734
    28Monitor

    WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    tagdiv · tagdiv composerJul 13, 2026

  • CVE-2026-57733
    28Monitor

    WordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    tagdiv · tagdiv cloud libraryJul 13, 2026

  • CVE-2026-57732
    28Monitor

    WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    tagdiv · tagdiv opt-in builderJul 13, 2026

  • CVE-2026-57729
    30Monitor

    WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    ux-themes · flatsomeJul 13, 2026

  • CVE-2026-57728
    28Monitor

    WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    ux-themes · flatsomeJul 13, 2026

  • CVE-2026-57731
    26Monitor

    WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    ux-themes · flatsomeJul 2, 2026

  • CVE-2026-57730
    17Monitor

    WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    ux-themes · flatsomeJul 2, 2026

  • CVE-2025-69132
    26Monitor

    WordPress Corpkit theme <= 1.0.5 - Sensitive Data Exposure vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    zozothemes · corpkitJul 2, 2026