Skip to content
Noroxi

Hiro (Code016Hiro)

Patchstack Bug Bounty Program

17 credited records · 0 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers
  • CVE-2025-57921
    21Monitor

    WordPress Frontend File Manager plugin <= 23.3 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    n-media · frontend file managerSep 22, 2025

  • CVE-2025-58797
    21Monitor

    WordPress Ninja Charts plugin <= 3.3.5 - Sensitive Data Exposure vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    mahmudul hasan arif · ninja chartsSep 5, 2025

  • CVE-2025-58603
    21Monitor

    WordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control Vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    surfer · surferSep 3, 2025

  • CVE-2025-54049
    39Monitor

    WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    miniorange · custom api for wpAug 20, 2025

  • CVE-2025-54048
    37Monitor

    WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    miniorange · custom api for wpAug 20, 2025

  • CVE-2025-54040
    26Monitor

    WordPress Webba Booking <= 5.1.20 - Broken Access Control Vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    webba appointment booking · webba bookingAug 20, 2025

  • CVE-2025-52818
    32Monitor

    WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    dejan jasnic · trusty whistleblowingJun 27, 2025

  • CVE-2025-49989
    21Monitor

    WordPress App Builder plugin <= 5.5.6 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    app cheap · app builderJun 20, 2025

  • CVE-2025-28972
    30Monitor

    WordPress WP Employee Attendance System plugin <= 3.5 - SQL Injection Vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    suhas surse · wp employee attendance systemJun 17, 2025

  • CVE-2025-49325
    18Monitor

    WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability

    MediumCVSS 4.7No exploitEPSS 0%

    automattic · newspack newslettersJun 6, 2025

  • CVE-2025-49324
    21Monitor

    WordPress Job Board Manager plugin <= 2.1.60 - Broken Access Control Vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    pickplugins · job board managerJun 6, 2025

  • CVE-2025-30945
    21Monitor

    WordPress Taskbuilder plugin <= 4.0.7 - Broken Access Control Vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    taskbuilder · taskbuilderJun 6, 2025

  • CVE-2025-29005
    17Monitor

    WordPress HR Management Lite plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    weblizar - wordpress themes & plugin · hr management liteJun 6, 2025

  • CVE-2025-28997
    21Monitor

    WordPress WP AutoKeyword plugin <= 1.0 - Broken Access Control Vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    exeideas international · wp autokeywordJun 6, 2025

  • CVE-2025-28985
    21Monitor

    WordPress Elastic Email Subscribe Form plugin <= 1.2.2 - Broken Access Control Vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    elastic email · elastic email subscribe formJun 6, 2025

  • CVE-2025-48241
    28Monitor

    WordPress Verge3D plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    soft8soft llc · verge3dMay 23, 2025

  • CVE-2025-46455
    37Monitor

    WordPress WP HRM LITE plugin <= 1.1 - SQL Injection Vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    indigothemes · wp hrm liteMay 23, 2025