Skip to content
Noroxi

PPzzAArr

Patchstack Bug Bounty Program

20 credited records · 19 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers
  • CVE-2026-27365
    23Monitor

    WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    publishpress · publishpress seriesAug 18, 2026

  • CVE-2026-27329
    21Monitor

    WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    yith · yith woocommerce wishlistMay 7, 2026

  • CVE-2026-27046
    26Monitor

    WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    kaira · storecustomizerMar 25, 2026

  • CVE-2026-25465
    26Monitor

    WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    codepeople · cp multi view event calendarMar 25, 2026

  • CVE-2026-24372
    30Monitor

    WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wp swings · subscriptions for woocommerceMar 25, 2026

  • CVE-2026-23972
    26Monitor

    WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    magepeopleteam · booking and rental managerMar 25, 2026

  • CVE-2026-31919
    17Monitor

    WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    josh kohlbach · advanced coupons for woocommerce couponsMar 13, 2026

  • CVE-2026-27344
    23Monitor

    WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability

    MediumCVSS 5.9Proof of conceptEPSS 0%

    inseriswiss · inseri coreMar 5, 2026

  • CVE-2026-24385
    30Monitor

    WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    gerritvanaaken · podlove web playerMar 5, 2026

  • CVE-2025-69343
    26Monitor

    WordPress Theater for WordPress plugin <= 0.19 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    jeroen schmit · theater for wordpressMar 5, 2026

  • CVE-2026-27042
    21Monitor

    WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    wpdeveloper · notificationxFeb 19, 2026

  • CVE-2026-24375
    21Monitor

    WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    wp swings · ultimate gift cards for woocommerceFeb 19, 2026

  • CVE-2026-24988
    26Monitor

    WordPress The Events Calendar Shortcode & Block plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    brian hogg · the events calendar shortcode & blockFeb 3, 2026

  • CVE-2026-24599
    21Monitor

    WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    xlplugins · nextmove liteJan 23, 2026

  • CVE-2026-24366
    21Monitor

    WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    yithemes · yith woocommerce request a quoteJan 22, 2026

  • CVE-2026-22461
    21Monitor

    WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    webappick · ctx feedJan 22, 2026

  • CVE-2025-69327
    17Monitor

    WordPress Car Rental Manager plugin <= 1.0.9 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    magepeopleteam · car rental managerJan 6, 2026

  • CVE-2025-67621
    17Monitor

    WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    10up · eight day week print workflowDec 24, 2025

  • CVE-2025-64253
    19Monitor

    WordPress Health Check & Troubleshooting plugin <= 1.7.1 - Path Traversal vulnerability

    MediumCVSS 4.9No exploitEPSS 0%

    wordpress.org · health check & troubleshootingDec 16, 2025

  • CVE-2025-47444
    21Monitor

    WordPress FiboSearch plugin <= 1.32.1 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    damian góra · fibosearchAug 12, 2025