Skip to content
Noroxi

dutafi

Patchstack Bug Bounty Program

68 credited records · 68 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers
  • CVE-2026-84814
    39Monitor

    WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    bricksforge. · bricksforgeSep 3, 2026

  • CVE-2026-81295
    28Monitor

    WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    underconstructionpage · under constructionSep 3, 2026

  • CVE-2026-81289
    28Monitor

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    sonaar · mp3 audio player for music, radio & podcast by sonaarSep 2, 2026

  • CVE-2026-81768
    28Monitor

    WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    highwarden · super store finderAug 31, 2026

  • CVE-2026-81760
    28Monitor

    WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    crocoblock · jetengineAug 28, 2026

  • CVE-2026-78281
    28Monitor

    WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    codepeople · cp media playerAug 27, 2026

  • CVE-2026-32550
    34Monitor

    WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    liquid web, llc · kadence shop kitAug 27, 2026

  • CVE-2026-78470
    26Monitor

    WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · wp project manager proAug 25, 2026

  • CVE-2026-78264
    28Monitor

    WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    site building with toolset · toolset blocksAug 24, 2026

  • CVE-2026-32478
    34Monitor

    WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    wedevs pte. ltd · wp project manager proAug 24, 2026

  • CVE-2026-32476
    28Monitor

    WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    amplebyte pvt limited · brave conversion engine (pro)Aug 24, 2026

  • CVE-2026-28166
    28Monitor

    WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    goodlayers · tourmasterAug 24, 2026

  • CVE-2026-68566
    37Monitor

    WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    repute infosystems · bookingpress appointment booking proAug 20, 2026

  • CVE-2026-66611
    28Monitor

    WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    paymob · paymob for woocommerceAug 20, 2026

  • CVE-2026-66609
    37Monitor

    WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    codexthemes · thegem (elementor)Aug 20, 2026

  • CVE-2026-66598
    28Monitor

    WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    kingtech llc. · b2bking premiumAug 20, 2026

  • CVE-2026-66594
    34Monitor

    WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    lukeseager · wordpress persistent loginAug 20, 2026

  • CVE-2026-66581
    28Monitor

    WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    crocoblock. jetimpex inc. · jetengineAug 20, 2026

  • CVE-2026-73182
    28Monitor

    WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    jeff starr · bbq proAug 19, 2026

  • CVE-2026-66613
    39Monitor

    WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    crocoblock. jetimpex inc. · jetengineAug 19, 2026

  • CVE-2026-32552
    34Monitor

    WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    yith · yith woocommerce membership premiumAug 19, 2026

  • CVE-2026-74015
    37Monitor

    WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    merkulove · readablerAug 18, 2026

  • CVE-2026-73404
    26Monitor

    WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    stylemix · masterstudy lmsAug 18, 2026

  • CVE-2026-73365
    37Monitor

    WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    crocoblock. jetimpex inc. · jetappointmentAug 18, 2026

  • CVE-2026-73360
    28Monitor

    WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    premio · chaty proAug 18, 2026