Skip to content
Noroxi

Dthangws

Patchstack Bug Bounty Program

18 credited records · 18 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for Dthangws

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits instantly.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-103962
    24Monitor

    User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter

    MediumCVSS 6.1No exploitEPSS 0%

    wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission6 days ago

  • CVE-2026-54854
    25Monitor

    WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability

    MediumCVSS 6.3No exploitEPSS 0%

    cozmoslabs · profile builderOct 30, 2026

  • CVE-2026-112844
    28Monitor

    WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    arraytics · wp event solutionOct 24, 2026

  • CVE-2026-105892
    39Monitor

    WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    rtcamp inc. · rtmedia for wordpress, buddypress and bbpressOct 10, 2026

  • CVE-2026-95608
    28Monitor

    WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    pluginus.net · huskyOct 9, 2026

  • CVE-2026-103065
    32Monitor

    WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    themeum · kirkiOct 3, 2026

  • CVE-2026-100180
    21Monitor

    Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment

    MediumCVSS 5.4No exploitEPSS 0%

    jegtheme · jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressOct 3, 2026

  • CVE-2026-102375
    26Monitor

    WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    optimole · optimoleSep 30, 2026

  • CVE-2026-97065
    28Monitor

    WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    happyforms · happyformsSep 30, 2026

  • CVE-2026-96352
    28Monitor

    WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    yithemes · yith woocommerce ajax searchSep 30, 2026

  • CVE-2026-85002
    27Monitor

    EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

    MediumCVSS 6.8No exploitEPSS 0%

    unknown · embedpressSep 27, 2026

  • CVE-2026-95515
    28Monitor

    WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    kevin stover · ninja formsSep 23, 2026

  • CVE-2026-89333
    26Monitor

    Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter

    MediumCVSS 6.5No exploitEPSS 0%

    themeum · tutor lms – elearning and online course solutionSep 18, 2026

  • CVE-2026-66574
    26Monitor

    WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    bdthemes · element pack elementor addonsSep 17, 2026

  • CVE-2026-18983
    30Monitor

    One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter

    HighCVSS 7.5No exploitEPSS 0%

    onedesigns · one user avatar | user profile pictureAug 28, 2026

  • CVE-2026-73352
    26Monitor

    WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    nexcess · givewpAug 18, 2026

  • CVE-2026-73348
    26Monitor

    WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    nexcess · givewpAug 18, 2026

  • CVE-2026-73349
    21Monitor

    WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    nexcess · givewpAug 13, 2026