Skip to content
Noroxi

Dave Jong (Patchstack)

Patchstack Bug Bounty Program

252 credited records · 7 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers
  • CVE-2026-28188
    29Monitor

    WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

    HighCVSS 7.3No exploitEPSS 0%

    themefic · hydra bookingAug 13, 2026

  • CVE-2026-65435
    26Monitor

    WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    thrive themes coupon · thrive leads versionJul 27, 2026

  • CVE-2024-54222
    17Monitor

    WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    seraphinite solutions · seraphinite acceleratorFeb 20, 2026

  • CVE-2023-25446
    30Monitor

    WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability

    HighCVSS 7.7No exploitEPSS 0%

    happyfiles · happyfiles proDec 20, 2025

  • CVE-2023-25445
    21Monitor

    WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    happyfiles · happyfiles proDec 20, 2025

  • CVE-2023-25068
    17Monitor

    WordPress Magazine Edge theme <= 1.13 - Authenticated Arbitrary Plugin Activation

    MediumCVSS 4.3No exploitEPSS 0%

    mapro collins · magazine edgeDec 20, 2025

  • CVE-2023-23729
    21Monitor

    WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    brainstorm force · spectraDec 9, 2025

  • CVE-2025-48333
    28Monitor

    WordPress eForm - WordPress Form Builder < 4.19.1 - Cross Site Scripting (XSS) Vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wpquark · eform - wordpress form builderJun 17, 2025

  • CVE-2025-39366
    35Monitor

    WordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    rocket apps · wprojectMay 19, 2025

  • CVE-2025-39365
    28Monitor

    WordPress wProject theme < 5.8.0 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    rocket apps · wprojectMay 19, 2025

  • CVE-2025-39350
    32Monitor

    WordPress wProject theme < 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    rocket apps · wprojectMay 19, 2025

  • CVE-2023-32240
    21Monitor

    WordPress Woodmart theme <= 7.2.1 - Broken Access Control vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    xtemos · woodmartJan 2, 2025

  • CVE-2024-37925
    21Monitor

    WordPress BuddyBoss Theme theme <= 2.4.61 - Cross Site Request Forgery (CSRF) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss llc · buddyboss themeJan 2, 2025

  • CVE-2024-37438
    21Monitor

    WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    uncanny owl · uncanny toolkit pro for learndashJan 2, 2025

  • CVE-2024-56069
    28Monitor

    WordPress WP SuperBackup plugin <= 2.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    azzaroco · wp superbackupJan 2, 2025

  • CVE-2024-56070
    29Monitor

    WordPress WP SuperBackup plugin <= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilities

    HighCVSS 7.4No exploitEPSS 0%

    azzaroco · wp superbackupDec 31, 2024

  • CVE-2024-56068
    30Monitor

    WordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    azzaroco · wp superbackupDec 31, 2024

  • CVE-2024-56067
    33Monitor

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 10%

    azzaroco · wp superbackupDec 31, 2024

  • CVE-2024-56064
    49Plan

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 31%

    azzaroco · wp superbackupDec 31, 2024

  • CVE-2023-30490
    30Monitor

    WordPress Easing Slider plugin <= 3.0.8 - Plugin Settings Reset Vulnerability

    HighCVSS 7.5No exploitEPSS 1%

    matthew ruddy · easing sliderDec 13, 2024

  • CVE-2023-28990
    17Monitor

    WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    hashthemes · viral magDec 13, 2024

  • CVE-2023-27456
    17Monitor

    WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

    MediumCVSS 4.3No exploitEPSS 0%

    hashthemes · totalDec 13, 2024

  • CVE-2024-54218
    26Monitor

    WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Plugin Settings Change vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    thehp · aio contactDec 9, 2024

  • CVE-2024-54220
    28Monitor

    WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    roninwp · fat services bookingDec 9, 2024

  • CVE-2024-54219
    28Monitor

    WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Site-Wide Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    thehp · aio contactDec 9, 2024