chuck

Patchstack Bug Bounty Program

5 credited records · 0 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
26Monitor	CVE-2025-28976No exploit	WordPress Email Address Security by WebEmailProtector plugin <= 3.3.6 - Cross Site Scripting (XSS) Vulnerabilitydsrodzin · email address security by webemailprotector · CWE-79 XSS	Medium6.5	—	0.2%	Jul 4, 2025
39Monitor	CVE-2025-48340No exploit	WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerabilitydanny vink · user profile meta manager · CWE-352 Pre-auth CSRF	Critical9.8	—	0.2%	May 19, 2025
21Monitor	CVE-2025-39545No exploit	WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerabilityminiorange · wordpress rest api authentication · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.5%	Apr 16, 2025
29Monitor	CVE-2025-39544No exploit	WordPress WP Tools plugin <= 5.18 - CSRF to Arbitrary File Deletion vulnerabilitysminozzi · wp tools · CWE-352 Pre-auth Path traversal CSRF	High7.4	—	0.3%	Apr 16, 2025
21Monitor	CVE-2025-32246No exploit	WordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control Vulnerabilitytim nguyen · 1-click backup & restore database · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.5%	Apr 4, 2025

CVE-2025-28976
26Monitor
WordPress Email Address Security by WebEmailProtector plugin <= 3.3.6 - Cross Site Scripting (XSS) Vulnerability
MediumCVSS 6.5No exploitEPSS 0%
- XSS
dsrodzin · email address security by webemailprotectorJul 4, 2025
CVE-2025-48340
39Monitor
WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- CSRF
danny vink · user profile meta managerMay 19, 2025
CVE-2025-39545
21Monitor
WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerability
MediumCVSS 5.4No exploitEPSS 1%
- Broken access control (IDOR)
miniorange · wordpress rest api authenticationApr 16, 2025
CVE-2025-39544
29Monitor
WordPress WP Tools plugin <= 5.18 - CSRF to Arbitrary File Deletion vulnerability
HighCVSS 7.4No exploitEPSS 0%
sminozzi · wp toolsApr 16, 2025
CVE-2025-32246
21Monitor
WordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control Vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
tim nguyen · 1-click backup & restore databaseApr 4, 2025