Skip to content
Noroxi

WPScan

4,688 credited records · 2,314 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for WPScan

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits every 10 minutes on paid plans, on the hour on the free plan.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • CVE alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools, at most 30 a day (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-76792
    32Monitor

    User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

    HighCVSS 8.1No exploitEPSS 0%

    unknown · user verification by pickpluginsToday

  • CVE-2026-124817
    21Monitor

    Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · clockinator liteToday

  • CVE-2026-124815
    40Plan

    Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

    CriticalCVSS 10.0No exploitEPSS 0%

    unknown · clockinator liteToday

  • CVE-2026-124814
    39Monitor

    Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

    CriticalCVSS 9.8No exploitEPSS 0%

    unknown · ultimate addons for elementor formsToday

  • CVE-2026-124665
    21Monitor

    Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · order trackingToday

  • CVE-2026-124653
    26Monitor

    Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

    MediumCVSS 6.5No exploitEPSS 0%

    unknown · mine cloudvodToday

  • CVE-2026-124652
    17Monitor

    Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR

    MediumCVSS 4.3No exploitEPSS 0%

    unknown · mine cloudvodToday

  • CVE-2026-124648
    21Monitor

    TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · ti woocommerce wishlistToday

  • CVE-2026-124647
    34Monitor

    TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie

    HighCVSS 8.6No exploitEPSS 0%

    unknown · ti woocommerce wishlistToday

  • CVE-2026-123092
    30Monitor

    WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

    HighCVSS 7.5No exploitEPSS 0%

    unknown · wp remote users syncToday

  • CVE-2026-123044
    30Monitor

    ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure

    HighCVSS 7.5No exploitEPSS 0%

    unknown · contentpenToday

  • CVE-2026-122003
    35Monitor

    Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF

    HighCVSS 8.8No exploitEPSS 0%

    unknown · abilities bridgeToday

  • CVE-2026-121498
    19Monitor

    Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR

    MediumCVSS 4.8No exploitEPSS 0%

    unknown · askanyToday

  • CVE-2026-119040
    30Monitor

    Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification

    HighCVSS 7.5No exploitEPSS 0%

    unknown · defender securityToday

  • CVE-2026-119039
    21Monitor

    Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · defender securityToday

  • CVE-2026-118531
    12Monitor

    Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update

    LowCVSS 3.1No exploitEPSS 0%

    unknown · directorist: ai-powered business directory, listings & classified adsToday

  • CVE-2026-118421
    27Monitor

    WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter

    MediumCVSS 6.8No exploitEPSS 0%

    unknown · wp directory kitToday

  • CVE-2026-110959
    39Monitor

    Descope < 1.2.0 - Unauthenticated Account Takeover

    CriticalCVSS 9.8No exploitEPSS 0%

    unknown · descopeToday

  • CVE-2026-110072
    27Monitor

    Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute

    MediumCVSS 6.8No exploitEPSS 0%

    unknown · photo gallery by 10webToday

  • CVE-2026-110041
    15Monitor

    Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints

    LowCVSS 3.8No exploitEPSS 0%

    unknown · crop thumbnailsToday

  • CVE-2026-106027
    21Monitor

    Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · oxygen mydata for woocommerceToday

  • CVE-2026-92408
    21Monitor

    WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · wps bookings for woocommerce1 day ago

  • CVE-2026-123668
    21Monitor

    GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · getpaid1 day ago

  • CVE-2026-123659
    21Monitor

    ProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta Disclosure

    MediumCVSS 5.3No exploitEPSS 0%

    unknown · profilepress1 day ago

  • CVE-2026-119302
    26Monitor

    NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview

    MediumCVSS 6.5No exploitEPSS 0%

    unknown · notificationx1 day ago