Skip to content
Noroxi

Powpy

Patchstack Bug Bounty Program

37 credited records · 36 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for Powpy

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits instantly.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-1256
    25Monitor

    YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input

    MediumCVSS 6.4No exploitEPSS 0%

    ysinnovations · ys leadgen – popup builder, popup maker & form builder for wordpress | lead generation, email marketing, sales, conversions, opt-ins & subscribersSep 19, 2026

  • CVE-2026-1856
    25Monitor

    Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label

    MediumCVSS 6.4No exploitEPSS 0%

    creavi · creavi appointment booking calendarJun 19, 2026

  • CVE-2025-14452
    28Monitor

    WP Customer Reviews <= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    bompus · wp customer reviewsFeb 19, 2026

  • CVE-2025-12707
    30Monitor

    Library Management System <= 3.2.1 - Unauthenticated SQL Injection

    HighCVSS 7.5No exploitEPSS 0%

    owthub · library management systemFeb 19, 2026

  • CVE-2026-1306
    40Plan

    midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    adminkov · midi-synthFeb 14, 2026

  • CVE-2025-14610
    28Monitor

    TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    bloompixel · tablemaster for elementor – advanced responsive tables for elementorJan 28, 2026

  • CVE-2026-0694
    25Monitor

    SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

    MediumCVSS 6.4No exploitEPSS 0%

    searchwiz · searchwizJan 14, 2026

  • CVE-2025-14506
    25Monitor

    ConvertForce Popup Builder <= 0.0.7 - Stored Cross-Site Scripting via entrance_animation

    MediumCVSS 6.4No exploitEPSS 0%

    imtiazrayhan · convertforce popup builderJan 10, 2026

  • CVE-2025-11453
    25Monitor

    Header and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 6.4No exploitEPSS 0%

    anand_kumar · header and footer scriptsJan 9, 2026

  • CVE-2025-14626
    25Monitor

    QR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributes

    MediumCVSS 6.4No exploitEPSS 0%

    www15to · qr code for woocommerce order emails, pdf invoices, packing slipsJan 7, 2026

  • CVE-2025-14453
    25Monitor

    My Album Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attribute

    MediumCVSS 6.4No exploitEPSS 0%

    ruhul080 · my album galleryJan 7, 2026

  • CVE-2025-14153
    26Monitor

    Page Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode Attribute

    MediumCVSS 6.5No exploitEPSS 0%

    vikasratudi · page expire popup/redirection for wordpressJan 6, 2026

  • CVE-2025-49339
    17Monitor

    WordPress Direct Payments WP plugin <= 1.3.2 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    digages · direct payments wpDec 31, 2025

  • CVE-2025-49352
    17Monitor

    WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    yoohw studio · order cancellation & returns for woocommerceDec 31, 2025

  • CVE-2025-49356
    17Monitor

    WordPress Orders Chat for WooCommerce plugin <= 1.2.0 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    mykola lukin · orders chat for woocommerceDec 31, 2025

  • CVE-2025-49334
    21Monitor

    WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    eduardo villão · myd deliveryDec 31, 2025

  • CVE-2025-13693
    25Monitor

    Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting

    MediumCVSS 6.4No exploitEPSS 0%

    wpchill · image photo gallery final tiles gridDec 21, 2025

  • CVE-2025-14003
    17Monitor

    Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification

    MediumCVSS 4.3No exploitEPSS 0%

    wpchill · modula image gallery – photo grid & video galleryDec 15, 2025

  • CVE-2025-14365
    21Monitor

    Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion

    MediumCVSS 5.3No exploitEPSS 0%

    dugudlabs · eyewear prescription formDec 13, 2025

  • CVE-2025-12109
    25Monitor

    Header Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 6.4No exploitEPSS 0%

    mahethekiller · header footer script adder – insert code in header, body & footerDec 13, 2025

  • CVE-2025-14068
    30Monitor

    WPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    qdonow · wpnakama – team and multi-client collaboration, editorial and project managementDec 12, 2025

  • CVE-2025-14166
    21Monitor

    WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection

    MediumCVSS 5.3No exploitEPSS 0%

    ludwigyou · wpmastertoolkit (wpmtk) – all in one pluginDec 12, 2025

  • CVE-2025-12783
    17Monitor

    Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update

    MediumCVSS 4.3No exploitEPSS 0%

    premmerce · premmerce brands for woocommerceDec 12, 2025

  • CVE-2025-12782
    17Monitor

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering

    MediumCVSS 4.3No exploitEPSS 0%

    fastlinemedia · beaver builderDec 4, 2025

  • CVE-2025-13157
    21Monitor

    QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update

    MediumCVSS 5.3No exploitEPSS 0%

    qodeinteractive · qode wishlist for woocommerceNov 27, 2025