Skip to content
Noroxi

dutafi

Patchstack Bug Bounty Program

80 credited records · 80 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for dutafi

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits instantly.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-78534
    28Monitor

    WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    keen it solutions · educavoOct 10, 2026

  • CVE-2026-39799
    28Monitor

    WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    joomunited · wp file downloadOct 10, 2026

  • CVE-2026-39790
    28Monitor

    WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    e4jvikwp · vikrentcarOct 6, 2026

  • CVE-2026-39771
    34Monitor

    WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    mightynetworks vs buddyboss · buddyboss platformOct 6, 2026

  • CVE-2026-39754
    26Monitor

    WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    about piotnet · piotnet addons for elementorOct 6, 2026

  • CVE-2026-39748
    28Monitor

    WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    thememove · edumallOct 6, 2026

  • CVE-2026-39726
    28Monitor

    WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    lumise neo · lumise product designerOct 6, 2026

  • CVE-2026-32580
    30Monitor

    WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wpgenie · woocommerce lotteryOct 6, 2026

  • CVE-2026-32575
    28Monitor

    WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    fantastic plugins · sumo affiliates proOct 6, 2026

  • CVE-2026-32572
    28Monitor

    WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wedevs · wp user frontend proOct 6, 2026

  • CVE-2026-32569
    28Monitor

    WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    joomunited · wp media folderOct 6, 2026

  • CVE-2026-97273
    28Monitor

    WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    premmerce · premmerce wishlist for woocommerceOct 1, 2026

  • CVE-2026-84814
    39Monitor

    WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    bricksforge. · bricksforgeSep 3, 2026

  • CVE-2026-81295
    28Monitor

    WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    underconstructionpage · under constructionSep 3, 2026

  • CVE-2026-81289
    28Monitor

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    sonaar · mp3 audio player for music, radio & podcast by sonaarSep 2, 2026

  • CVE-2026-81768
    28Monitor

    WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    highwarden · super store finderAug 31, 2026

  • CVE-2026-81760
    28Monitor

    WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    crocoblock · jetengineAug 28, 2026

  • CVE-2026-78281
    28Monitor

    WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    codepeople · cp media playerAug 27, 2026

  • CVE-2026-32550
    34Monitor

    WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    liquid web, llc · kadence shop kitAug 27, 2026

  • CVE-2026-78470
    26Monitor

    WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · wp project manager proAug 25, 2026

  • CVE-2026-78264
    28Monitor

    WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    site building with toolset · toolset blocksAug 24, 2026

  • CVE-2026-32478
    34Monitor

    WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    wedevs pte. ltd · wp project manager proAug 24, 2026

  • CVE-2026-32476
    28Monitor

    WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    amplebyte pvt limited · brave conversion engine (pro)Aug 24, 2026

  • CVE-2026-28166
    28Monitor

    WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    goodlayers · tourmasterAug 24, 2026

  • CVE-2026-68566
    37Monitor

    WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    repute infosystems · bookingpress appointment booking proAug 20, 2026