Skip to content
Noroxi

ISMAILSHADOW

15 credited records · 10 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for ISMAILSHADOW

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits instantly.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-2374
    28Monitor

    Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF

    HighCVSS 7.2No exploitEPSS 0%

    robertpeake · login no captcha recaptchaMay 28, 2026

  • CVE-2026-4347
    32Monitor

    MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir

    HighCVSS 8.1No exploitEPSS 1%

    inc2734 · mw wp formApr 2, 2026

  • CVE-2026-3584
    41Plan

    Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    wpchill · kali forms — contact form & drag-and-drop builderMar 20, 2026

  • CVE-2025-14799
    26Monitor

    Brevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling

    MediumCVSS 6.5No exploitEPSS 0%

    neeraj_slit · brevo – email, sms, web push, chat, and more.Feb 18, 2026

  • CVE-2026-1927
    21Monitor

    GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored C

    MediumCVSS 5.4No exploitEPSS 0%

    wpsoul · greenshift – animation and page builder blocksFeb 5, 2026

  • CVE-2025-14437
    31Monitor

    Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File

    HighCVSS 7.5Proof of conceptEPSS 1%

    wpmudev · hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdnDec 18, 2025

  • CVE-2025-13645
    28Monitor

    Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion

    HighCVSS 7.2No exploitEPSS 1%

    wpchill · modula image galleryDec 3, 2025

  • CVE-2025-13536
    35Monitor

    Blubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'

    HighCVSS 8.8No exploitEPSS 0%

    blubrry · powerpress podcasting plugin by blubrryNov 27, 2025

  • CVE-2025-12844
    28Monitor

    AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization

    HighCVSS 7.1No exploitEPSS 0%

    tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressNov 13, 2025

  • CVE-2025-9334
    35Monitor

    Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection

    HighCVSS 8.8No exploitEPSS 0%

    codesolz · better find and replace – ai-powered suggestionsNov 8, 2025

  • CVE-2025-6189
    26Monitor

    Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter

    MediumCVSS 6.5No exploitEPSS 0%

    arjunthakur · duplicate page and postSep 10, 2025

  • CVE-2025-8268
    26Monitor

    Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion

    MediumCVSS 6.5No exploitEPSS 0%

    tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressSep 3, 2025

  • CVE-2025-7847
    35Monitor

    AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 1%

    tigroumeow · ai engineJul 31, 2025

  • CVE-2025-7780
    26Monitor

    AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions

    MediumCVSS 6.5No exploitEPSS 0%

    tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressJul 24, 2025

  • CVE-2025-7367
    25Monitor

    Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields

    MediumCVSS 6.4No exploitEPSS 0%

    wpchill · strong testimonialsJul 15, 2025