Skip to content
Noroxi

VanTastic

Patchstack Bug Bounty Program

31 credited records · 31 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers
  • CVE-2026-81283
    35Monitor

    WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    wedevs · wp user frontendSep 2, 2026

  • CVE-2026-28167
    30Monitor

    WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

    HighCVSS 7.5No exploitEPSS 1%

    super forms · super formsAug 24, 2026

  • CVE-2026-28165
    39Monitor

    WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    unitedover, llc · digitsAug 24, 2026

  • CVE-2026-73339
    37Monitor

    WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    webnus inc. · modern events calendarAug 18, 2026

  • CVE-2026-66691
    39Monitor

    WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    scriptsbundle · nokriAug 13, 2026

  • CVE-2026-28189
    29Monitor

    WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

    HighCVSS 7.4No exploitEPSS 0%

    roland barker · participants databaseAug 13, 2026

  • CVE-2026-28174
    26Monitor

    WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    arraytics · wp event solutionAug 13, 2026

  • CVE-2026-28173
    28Monitor

    WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    arraytics · wp event solutionAug 13, 2026

  • CVE-2026-65509
    28Monitor

    WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wpdatatables · wpdatatablesAug 6, 2026

  • CVE-2026-59536
    30Monitor

    WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    cocart headless · cocart – headless ecommerceJul 27, 2026

  • CVE-2026-65495
    30Monitor

    WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    dokan multivendor plugin · dokan proJul 23, 2026

  • CVE-2026-59544
    39Monitor

    WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    thrive themes coupon · thrive quiz builderJul 23, 2026

  • CVE-2026-59515
    37Monitor

    WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    sergey · aiwuJul 13, 2026

  • CVE-2026-57771
    34Monitor

    WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    milan petrovic · gd rating systemJul 13, 2026

  • CVE-2026-57725
    28Monitor

    WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    themeum · kirkiJul 13, 2026

  • CVE-2026-57724
    39Monitor

    WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    themeum · kirkiJul 13, 2026

  • CVE-2026-57390
    26Monitor

    WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    edgarrojas · extra product options builder for woocommerceJul 13, 2026

  • CVE-2026-57680
    26Monitor

    WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    themeum · kirkiJul 2, 2026

  • CVE-2026-56069
    30Monitor

    WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    site building with toolset · toolset formsJun 26, 2026

  • CVE-2026-56057
    39Monitor

    WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    uncanny owl · uncanny automator proJun 26, 2026

  • CVE-2026-56033
    39Monitor

    WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    dokan multivendor plugin · dokan proJun 26, 2026

  • CVE-2026-56031
    32Monitor

    WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    uncanny owl · uncanny automatorJun 26, 2026

  • CVE-2026-56053
    35Monitor

    WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    eventprime · eventprimeJun 25, 2026

  • CVE-2026-54189
    28Monitor

    WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    jetimpex inc. · jetengineJun 17, 2026

  • CVE-2026-54188
    28Monitor

    WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    jetimpex inc. · jetengineJun 17, 2026