Skip to content
Noroxi

UKO

Patchstack Bug Bounty Program

18 credited records · 5 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers
  • CVE-2026-88996
    24Monitor

    WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

    MediumCVSS 6.1No exploitEPSS 0%

    smub · wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & more5 days ago

  • CVE-2026-15797
    25Monitor

    Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title

    MediumCVSS 6.4No exploitEPSS 0%

    danieliser · popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builderSep 18, 2026

  • CVE-2026-85414
    25Monitor

    Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute

    MediumCVSS 6.4No exploitEPSS 0%

    fooplugins · gallery : foogallerySep 5, 2026

  • CVE-2026-15446
    25Monitor

    EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

    MediumCVSS 6.4No exploitEPSS 0%

    nosilver4u · ewww image optimizerAug 19, 2026

  • CVE-2026-15988
    35Monitor

    AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

    HighCVSS 8.8No exploitEPSS 0%

    tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressAug 1, 2026

  • CVE-2025-31627
    23Monitor

    WordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    david lingren · media library assistantMar 31, 2025

  • CVE-2025-24579
    23Monitor

    WordPress Nested pages plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    kyle phillips · nested pagesJan 24, 2025

  • CVE-2025-22762
    23Monitor

    WordPress Octrace Support Pro plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    octrace · wordpress helpdesk & support ticket system plugin – octrace supportJan 15, 2025

  • CVE-2024-52493
    23Monitor

    WordPress Meteor Slides plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    meteor slides project · meteor slidesDec 2, 2024

  • CVE-2024-52492
    23Monitor

    WordPress Image horizontal reel scroll slideshow plugin <= 13.4 - Stored Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    gopiplus · image horizontal reel scroll slideshowDec 2, 2024

  • CVE-2024-52491
    23Monitor

    WordPress Sticky Social Icons plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    sanil shakya · sticky social iconsDec 2, 2024

  • CVE-2024-52489
    23Monitor

    WordPress Add Chat App Button plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    udidol · add chat app buttonDec 2, 2024

  • CVE-2024-50415
    23Monitor

    WordPress Ads.txt & App-ads.txt Manager for WordPress plugin <= 1.1.7.1 - Stored Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    pagup · ads.txt & app-ads.txt manager for wordpressOct 29, 2024

  • CVE-2024-50414
    23Monitor

    WordPress Button contact VR plugin <= 4.7.9.1 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    buttonizer · button contact vrOct 29, 2024

  • CVE-2024-50413
    23Monitor

    WordPress Import and export users and customers plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    javier carazo · import and export users and customersOct 29, 2024

  • CVE-2024-50412
    23Monitor

    WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    jules colle · conditional fields for contact form 7Oct 29, 2024

  • CVE-2024-50411
    19Monitor

    WordPress WP Abstracts plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 4.8No exploitEPSS 0%

    kevonadonis · wp abstractsOct 29, 2024

  • CVE-2024-48046
    23Monitor

    WordPress Contact Form by Supsystic plugin <= 1.7.28 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9No exploitEPSS 0%

    supsystic · contact form by supsysticOct 17, 2024