Skip to content
Noroxi

mcdruid

Patchstack Bug Bounty Program

44 credited records · 24 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for mcdruid

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits every 10 minutes on paid plans, on the hour on the free plan.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • CVE alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools, at most 30 a day (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-11371
    24Monitor

    BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection

    MediumCVSS 6.1No exploitEPSS 0%

    unknown · betterdocsJul 16, 2026

  • CVE-2026-6382
    36Monitor

    Multiple elFinder Plugins - Authenticated OS Command Injection

    CriticalCVSS 9.1No exploitEPSS 1%

    unknown · fileorganizerJul 6, 2026

  • CVE-2026-27366
    30Monitor

    WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    mainwp · mainwp childJun 25, 2026

  • CVE-2026-40720
    28Monitor

    WordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    royal elementor addons · royal elementor addons proJun 17, 2026

  • CVE-2026-27410
    26Monitor

    WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    veronalabs · slimstat analyticsJun 17, 2026

  • CVE-2026-48838
    28Monitor

    WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wpexperts · post smtpJun 15, 2026

  • CVE-2026-4935
    34Monitor

    SureTriggers < 1.1.23 – Unauthenticated SQLi

    HighCVSS 8.6No exploitEPSS 0%

    unknown · ottokit: all-in-one automation platformMay 8, 2026

  • CVE-2026-3830
    34Monitor

    Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi

    HighCVSS 8.6No exploitEPSS 0%

    unknown · product filter for woocommerce by wbwApr 13, 2026

  • CVE-2026-25345
    39Monitor

    WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    gallerycreator · simply galleryMar 25, 2026

  • CVE-2026-32358
    30Monitor

    WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    wpdevelop · booking calendarMar 13, 2026

  • CVE-2026-28135
    32Monitor

    WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    wp royal · royal elementor addonsMar 5, 2026

  • CVE-2026-27984
    36Monitor

    WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.0No exploitEPSS 0%

    marketing fire · widget optionsMar 5, 2026

  • CVE-2025-69323
    28Monitor

    WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    veronalabs · slimstat analyticsFeb 20, 2026

  • CVE-2026-22333
    28Monitor

    WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    yithemes · yith woocommerce compareFeb 19, 2026

  • CVE-2025-69319
    30Monitor

    WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    beaver builder · beaver builderJan 22, 2026

  • CVE-2025-68898
    23Monitor

    WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.8No exploitEPSS 0%

    cjjparadoxmax · synergy project managerJan 22, 2026

  • CVE-2025-68864
    28Monitor

    WordPress Infility Global plugin <= 2.15.11 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    infility · infility globalJan 22, 2026

  • CVE-2025-49335
    19Monitor

    WordPress External Media plugin <= 1.0.36 - Server Side Request Forgery (SSRF) vulnerability

    MediumCVSS 4.9No exploitEPSS 0%

    minnur · external mediaJan 7, 2026

  • CVE-2025-68865
    37Monitor

    WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    infility · infility globalJan 5, 2026

  • CVE-2025-68897
    39Monitor

    WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    mohammad i. okfie · if as shortcodeDec 29, 2025

  • CVE-2025-64227
    39Monitor

    WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    boldgrid · client invoicing by sprout invoicesDec 18, 2025

  • CVE-2025-67962
    30Monitor

    WordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    aioseo plugin team · broken link checkerDec 16, 2025

  • CVE-2025-67950
    34Monitor

    WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    syed balkhi · all in one seo packDec 16, 2025

  • CVE-2025-67467
    21Monitor

    WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    stellarwp · givewpDec 9, 2025

  • CVE-2025-49386
    35Monitor

    WordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    scott reilly · preserve code formattingNov 6, 2025