Skip to content
Noroxi

Phú

25 credited records · 25 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for Phú

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits instantly.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-3652
    28Monitor

    ARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    Jun 24, 2026

  • CVE-2026-8442
    32Monitor

    WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter

    HighCVSS 8.1No exploitEPSS 0%

    https://wpreviewslider.com/ · wp review slider proJun 16, 2026

  • CVE-2026-8444
    35Monitor

    WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter

    HighCVSS 8.8No exploitEPSS 0%

    https://wpreviewslider.com/ · wp review slider proJun 16, 2026

  • CVE-2026-8443
    35Monitor

    WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter

    HighCVSS 8.8No exploitEPSS 0%

    https://wpreviewslider.com/ · wp review slider proJun 16, 2026

  • CVE-2026-5411
    35Monitor

    WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 0%

    webfactory · advanced google recaptchaJun 5, 2026

  • CVE-2026-5076
    39Monitor

    ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    armember · armember premium – membership plugin, content restriction, member levels, user profile & user signupJun 2, 2026

  • CVE-2026-5074
    26Monitor

    ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter

    MediumCVSS 6.5No exploitEPSS 0%

    armember · armember premium – membership plugin, content restriction, member levels, user profile & user signupJun 2, 2026

  • CVE-2026-5073
    30Monitor

    ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter

    HighCVSS 7.5Proof of conceptEPSS 1%

    armember · armember premium – membership plugin, content restriction, member levels, user profile & user signupJun 2, 2026

  • CVE-2026-6898
    35Monitor

    WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action

    HighCVSS 8.8No exploitEPSS 0%

    wishlist member · wishlist memberMay 23, 2026

  • CVE-2026-6897
    35Monitor

    Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings

    HighCVSS 8.8No exploitEPSS 0%

    wishlist member · wishlist memberMay 23, 2026

  • CVE-2026-6895
    35Monitor

    Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' A

    HighCVSS 8.8No exploitEPSS 0%

    wishlist member · wishlist memberMay 23, 2026

  • CVE-2026-6419
    35Monitor

    Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX a

    HighCVSS 8.8No exploitEPSS 0%

    wishlist member · wishlist memberMay 23, 2026

  • CVE-2026-6960
    39Monitor

    BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    repute infosystems · bookingpress appointment booking proMay 21, 2026

  • CVE-2026-6692
    35Monitor

    Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url

    HighCVSS 8.8No exploitEPSS 0%

    revolution slider · slider revolutionMay 7, 2026

  • CVE-2026-4348
    30Monitor

    BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    betterdocs · betterdocs proMay 7, 2026

  • CVE-2026-6393
    17Monitor

    BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage

    MediumCVSS 4.3No exploitEPSS 0%

    wpdevteam · betterdocs – knowledge base docs & faq solution for elementor & block editorApr 24, 2026

  • CVE-2026-4352
    30Monitor

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    crocoblock · jetengineApr 13, 2026

  • CVE-2026-4351
    32Monitor

    Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter

    HighCVSS 8.1No exploitEPSS 0%

    perfmatters · perfmattersApr 9, 2026

  • CVE-2026-4350
    32Monitor

    Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter

    HighCVSS 8.1Proof of conceptEPSS 0%

    perfmatters · perfmattersApr 3, 2026

  • CVE-2026-3300
    40Plan

    Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    wpeverest · everest forms proMar 30, 2026

  • CVE-2026-4662
    30Monitor

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    crocoblock · jetengineMar 24, 2026

  • CVE-2026-3090
    28Monitor

    Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'

    HighCVSS 7.2No exploitEPSS 0%

    saadiqbal · post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile appMar 18, 2026

  • CVE-2026-3496
    30Monitor

    JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    crocoblock · jetbookingMar 11, 2026

  • CVE-2026-3492
    25Monitor

    Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title

    MediumCVSS 6.4No exploitEPSS 0%

    gravity forms · gravity formsMar 11, 2026

  • CVE-2026-2356
    21Monitor

    User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion

    MediumCVSS 5.3No exploitEPSS 0%

    wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderFeb 25, 2026