Skip to content
Noroxi

Kuba

60 credited records · 60 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for Kuba

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits every 10 minutes on paid plans, on the hour on the free plan.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • CVE alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools, at most 30 a day (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-118267
    32Monitor

    WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert

    HighCVSS 8.1Proof of conceptEPSS 1%

    peterschulznl · wp data access – app builder for tables, forms, dashboards, charts & maps5 days ago

  • CVE-2026-109991
    30Monitor

    FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay

    HighCVSS 7.5No exploitEPSS 0%

    teamfunnelkit · funnelkit payment gateway for stripe woocommerce5 days ago

  • CVE-2026-102564
    26Monitor

    Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over

    MediumCVSS 6.5No exploitEPSS 0%

    wpvibes · dynific addons for elementor (formerly anywhere elementor)5 days ago

  • CVE-2026-120548
    21Monitor

    YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php

    MediumCVSS 5.3No exploitEPSS 0%

    icopydoc · yml for yandex market5 days ago

  • CVE-2026-103917
    26Monitor

    Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter

    MediumCVSS 6.5No exploitEPSS 0%

    expresstech · quiz and survey master (qsm) – quiz maker & survey maker5 days ago

  • CVE-2026-120043
    30Monitor

    Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    iovamihai · affiliate program suite — slicewp affiliates5 days ago

  • CVE-2026-120560
    26Monitor

    Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters

    MediumCVSS 6.5No exploitEPSS 0%

    realmag777 · active woot products tables for woocommerce. 100% free5 days ago

  • CVE-2026-121519
    25Monitor

    Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter

    MediumCVSS 6.4No exploitEPSS 0%

    themeisle · social slider feed – social media feed & gallery widgets6 days ago

  • CVE-2026-120082
    28Monitor

    GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content

    HighCVSS 7.2No exploitEPSS 0%

    paoltaia · geodirectory – wp business directory plugin and classified listings directory6 days ago

  • CVE-2026-119616
    23Monitor

    Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

    MediumCVSS 5.9No exploitEPSS 0%

    picocodes · noptin – newsletter, new post notifications & email automation6 days ago

  • CVE-2026-116551
    25Monitor

    WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

    MediumCVSS 6.4No exploitEPSS 0%

    aguilatechnologies · wp customer area6 days ago

  • CVE-2026-103908
    21Monitor

    AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info

    MediumCVSS 5.4No exploitEPSS 0%

    mohammed_kaludi · amp for wp – accelerated mobile pages6 days ago

  • CVE-2026-100151
    24Monitor

    Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter

    MediumCVSS 6.1No exploitEPSS 0%

    kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderOct 31, 2026

  • CVE-2026-103915
    21Monitor

    Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter

    MediumCVSS 5.3No exploitEPSS 0%

    melograno · booking for appointments and events calendar – ameliaOct 31, 2026

  • CVE-2026-120070
    35Monitor

    User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

    HighCVSS 8.8No exploitEPSS 0%

    wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionOct 31, 2026

  • CVE-2026-119096
    39Monitor

    Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

    CriticalCVSS 9.8No exploitEPSS 0%

    uncannyowl · uncanny toolkit for learndashOct 31, 2026

  • CVE-2026-110023
    23Monitor

    WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter

    MediumCVSS 5.9No exploitEPSS 0%

    peterschulznl · wp data access – app builder for tables, forms, dashboards, charts & mapsOct 31, 2026

  • CVE-2026-103997
    26Monitor

    Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_na

    MediumCVSS 6.5No exploitEPSS 0%

    davidanderson · redux frameworkOct 31, 2026

  • CVE-2026-119980
    26Monitor

    UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash

    MediumCVSS 6.5No exploitEPSS 0%

    stiofansisland · userswp – front-end login form, user registration, user profile & members directory plugin for wpOct 31, 2026

  • CVE-2026-110251
    21Monitor

    Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter

    MediumCVSS 5.4No exploitEPSS 0%

    villatheme · revopic – photo reviews for woocommerceOct 31, 2026

  • CVE-2026-100155
    26Monitor

    Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag

    MediumCVSS 6.5No exploitEPSS 0%

    kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderOct 31, 2026

  • CVE-2026-110001
    21Monitor

    FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

    MediumCVSS 5.4No exploitEPSS 0%

    foliovision · fv flowplayer video playerOct 30, 2026

  • CVE-2026-107630
    30Monitor

    Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_ord

    HighCVSS 7.5No exploitEPSS 0%

    saadiqbal · email templates customizer and designer for wordpress and woocommerceOct 30, 2026

  • CVE-2026-102905
    26Monitor

    Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter

    MediumCVSS 6.5No exploitEPSS 0%

    spacetime · ad inserter – ad manager & adsense adsOct 30, 2026

  • CVE-2026-110184
    30Monitor

    Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    blazethemes · newsmaticOct 29, 2026