wcraft

Patchstack Bug Bounty Program

9 credited records · 3 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Credited records

Researchers

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-3430No exploit	Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLiunknown · creative mail · CWE-89 Pre-auth SQL injection	High8.6	—	0.4%	Aug 6, 2026
21Monitor	CVE-2025-13820No exploit	Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeoverunknown · comments · CWE-269 Pre-auth	Medium5.3	—	0.2%	Jan 1, 2026
43Plan	CVE-2025-9501Proof of concept	W3 Total Cache < 2.8.13 - Unauthenticated Command Injectionunknown · w3 total cache · CWE-78 pre-auth RCE Command injection	Critical9.0	—	22.1%	Nov 17, 2025
39Monitor	CVE-2025-9083No exploit	Ninja-forms < 3.11.1 - Unauthenticated PHP Objectionninjaforms · ninja forms · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Sep 18, 2025
21Monitor	CVE-2024-53823No exploit	WordPress The Plus Addons for Elementor plugin <= 5.6.14 - Cross Site Scripting (XSS) vulnerabilityposimyth · the plus addons for elementor · CWE-79 XSS	Medium5.4	—	0.2%	Dec 6, 2024
28Monitor	CVE-2024-50442No exploit	WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerabilityroyal-elementor-addons · royal elementor addons · CWE-611 XXE	High7.2	—	0.5%	Oct 28, 2024
23Monitor	CVE-2024-47345No exploit	WordPress Starter Templates plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerabilitybrainstorm force · starter templates · CWE-79 XSS	Medium5.9	—	0.2%	Oct 6, 2024
21Monitor	CVE-2024-39649No exploit	WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerabilitywpdeveloper · essential addons for elementor · CWE-79 XSS	Medium5.4	—	0.2%	Aug 1, 2024
21Monitor	CVE-2024-37922No exploit	WordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerabilityleap13 · premium addons for elementor · CWE-79 XSS	Medium5.4	—	0.2%	Jul 20, 2024

CVE-2026-3430
34Monitor
Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · creative mailAug 6, 2026
CVE-2025-13820
21Monitor
Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
unknown · commentsJan 1, 2026
CVE-2025-9501
43Plan
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
CriticalCVSS 9.0Proof of conceptEPSS 22%
- pre-auth RCE
- Command injection
unknown · w3 total cacheNov 17, 2025
CVE-2025-9083
39Monitor
Ninja-forms < 3.11.1 - Unauthenticated PHP Objection
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
ninjaforms · ninja formsSep 18, 2025
CVE-2024-53823
21Monitor
WordPress The Plus Addons for Elementor plugin <= 5.6.14 - Cross Site Scripting (XSS) vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- XSS
posimyth · the plus addons for elementorDec 6, 2024
CVE-2024-50442
28Monitor
WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability
HighCVSS 7.2No exploitEPSS 0%
- XXE
royal-elementor-addons · royal elementor addonsOct 28, 2024
CVE-2024-47345
23Monitor
WordPress Starter Templates plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability
MediumCVSS 5.9No exploitEPSS 0%
- XSS
brainstorm force · starter templatesOct 6, 2024
CVE-2024-39649
21Monitor
WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- XSS
wpdeveloper · essential addons for elementorAug 1, 2024
CVE-2024-37922
21Monitor
WordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- XSS
leap13 · premium addons for elementorJul 20, 2024