Skip to content
Noroxi

daroo

Patchstack Bug Bounty Program

369 credited records · 366 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for daroo

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits every 10 minutes on paid plans, on the hour on the free plan.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • CVE alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools, at most 30 a day (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-126537
    36Monitor

    Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    saturdaydrive · ninja forms - file uploads2 days ago

  • CVE-2026-84938
    28Monitor

    Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook

    HighCVSS 7.2No exploitEPSS 0%

    themefusion · avada (fusion) builder3 days ago

  • CVE-2026-120512
    28Monitor

    Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value

    HighCVSS 7.2No exploitEPSS 0%

    10web · form maker by 10web – mobile-friendly drag & drop contact form builderNov 7, 2026

  • CVE-2026-116522
    28Monitor

    Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode

    HighCVSS 7.2No exploitEPSS 0%

    comesio · relevanssi – a better searchOct 31, 2026

  • CVE-2026-109997
    28Monitor

    Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization

    HighCVSS 7.2No exploitEPSS 0%

    kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderOct 31, 2026

  • CVE-2026-90437
    28Monitor

    Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values

    HighCVSS 7.2No exploitEPSS 0%

    gravity forms · gravity formsOct 30, 2026

  • CVE-2026-93293
    25Monitor

    Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler

    MediumCVSS 6.4No exploitEPSS 0%

    saadiqbal · password protected – protect your site content with a passwordOct 29, 2026

  • CVE-2026-106013
    39Monitor

    Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

    CriticalCVSS 9.8No exploitEPSS 0%

    artbees · jupiter x coreOct 28, 2026

  • CVE-2026-75891
    35Monitor

    Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint

    HighCVSS 8.8No exploitEPSS 0%

    themeum · kirki – freeform page builder, website builder & customizerOct 27, 2026

  • CVE-2026-109198
    28Monitor

    Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

    HighCVSS 7.2No exploitEPSS 0%

    cleantalk · cleantalk anti-spam – complete spam protectionOct 23, 2026

  • CVE-2026-109208
    28Monitor

    LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

    HighCVSS 7.2No exploitEPSS 0%

    thimpress · learnpress – wordpress lms plugin for create and sell online coursesOct 17, 2026

  • CVE-2026-100106
    25Monitor

    FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter

    MediumCVSS 6.4No exploitEPSS 0%

    damian-gora · fibosearch – ajax search for woocommerceOct 16, 2026

  • CVE-2026-97640
    28Monitor

    WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

    HighCVSS 7.2No exploitEPSS 0%

    smub · wpconsent – cookie banner & cookie consent for privacy compliance (gdpr / ccpa / eu compliance cookie notice)Oct 16, 2026

  • CVE-2026-107768
    28Monitor

    TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

    HighCVSS 7.2No exploitEPSS 0%

    cozmoslabs · translatepress – translate multilingual sites with ai translationOct 16, 2026

  • CVE-2026-104798
    39Monitor

    My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

    CriticalCVSS 9.8No exploitEPSS 0%

    joedolson · my calendar – accessible event managerOct 16, 2026

  • CVE-2026-93953
    32Monitor

    Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation

    HighCVSS 8.0No exploitEPSS 0%

    softaculous · backuply – backup, restore, migrate and cloneOct 16, 2026

  • CVE-2026-81797
    39Monitor

    WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · buzz stone | magazine & viral blog wordpress themeOct 10, 2026

  • CVE-2026-78535
    39Monitor

    WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · photoliaOct 10, 2026

  • CVE-2026-62037
    28Monitor

    WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    bplugins · document embedderOct 10, 2026

  • CVE-2026-40803
    28Monitor

    WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    jotform · jotform &#8211; ai chatbotOct 10, 2026

  • CVE-2026-107742
    28Monitor

    10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

    HighCVSS 7.2No exploitEPSS 0%

    10web · 10web booster – website speed optimization, cache & page speed optimizerOct 10, 2026

  • CVE-2026-94167
    28Monitor

    WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    extend themes · kubio ai page builderOct 9, 2026

  • CVE-2026-104670
    28Monitor

    WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    thimpress · learnpressOct 6, 2026

  • CVE-2026-97338
    25Monitor

    Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name

    MediumCVSS 6.4No exploitEPSS 0%

    codename065 · download managerOct 2, 2026

  • CVE-2026-100107
    28Monitor

    Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

    HighCVSS 7.2No exploitEPSS 0%

    extendthemes · kubio ai page builderOct 2, 2026