Skip to content
Noroxi

zaim

Patchstack Bug Bounty Program

115 credited records · 32 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for zaim

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits instantly.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-4791
    25Monitor

    PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute

    MediumCVSS 6.4No exploitEPSS 0%

    peprodev · peprodev ultimate profile solutionsOct 10, 2026

  • CVE-2026-7438
    25Monitor

    Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    MediumCVSS 6.4No exploitEPSS 0%

    boldthemes · bold timeline liteSep 11, 2026

  • CVE-2026-7441
    25Monitor

    Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 6.4No exploitEPSS 0%

    alphawolf · simple yearly archiveAug 5, 2026

  • CVE-2026-6972
    25Monitor

    SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 6.4No exploitEPSS 0%

    sonalsinha21 · skt skill barAug 5, 2026

  • CVE-2026-7436
    25Monitor

    WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute

    MediumCVSS 6.4No exploitEPSS 0%

    wpclever · wpc badge management for woocommerceJul 29, 2026

  • CVE-2026-27403
    26Monitor

    WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    nerdpress · hubbub liteJul 23, 2026

  • CVE-2026-7640
    25Monitor

    WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

    MediumCVSS 6.4No exploitEPSS 0%

    aguilatechnologies · wp customer areaJul 13, 2026

  • CVE-2026-1382
    25Monitor

    fresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes

    MediumCVSS 6.4No exploitEPSS 0%

    freshlabs · fresh podcasterJul 11, 2026

  • CVE-2026-13710
    25Monitor

    Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Wid

    MediumCVSS 6.4No exploitEPSS 0%

    jegtheme · jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressJul 10, 2026

  • CVE-2026-6910
    25Monitor

    Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    MediumCVSS 6.4No exploitEPSS 0%

    safistudio · bookero.pl – system rezerwacji onlineJul 9, 2026

  • CVE-2025-14785
    25Monitor

    Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site

    MediumCVSS 6.4No exploitEPSS 0%

    seedprod · website builder by seedprod — theme builder, landing page builder, coming soon page, maintenance modeJul 8, 2026

  • CVE-2026-57764
    26Monitor

    WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    surbma · surbma | yoast seo breadcrumb shortcodeJul 2, 2026

  • CVE-2026-57763
    26Monitor

    WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    gordon böhme · structured contentJul 2, 2026

  • CVE-2026-57755
    26Monitor

    WordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    misbah wp · mosaic gallery &#8211; advanced galleryJul 2, 2026

  • CVE-2026-12732
    25Monitor

    LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute

    MediumCVSS 6.4No exploitEPSS 0%

    thimpress · learnpress – wordpress lms plugin for create and sell online coursesJul 1, 2026

  • CVE-2026-32455
    26Monitor

    WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    realmag777 · mdtfMar 13, 2026

  • CVE-2026-32450
    26Monitor

    WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    realmag777 · active products tables for woocommerceMar 13, 2026

  • CVE-2026-32449
    26Monitor

    WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    themifyme · themify event postMar 13, 2026

  • CVE-2026-32448
    26Monitor

    WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    eric teubert · podlove podcast publisherMar 13, 2026

  • CVE-2025-69011
    26Monitor

    WordPress Cool Tag Cloud plugin <= 2.29 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    wpkube · cool tag cloudFeb 20, 2026

  • CVE-2026-24630
    26Monitor

    WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    design · stylish cost calculatorJan 23, 2026

  • CVE-2026-22519
    26Monitor

    WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    buddydev · mediapressJan 8, 2026

  • CVE-2025-63005
    26Monitor

    WordPress WordPress Tooltips plugin <= 10.9.3 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    tomas · wordpress tooltipsDec 31, 2025

  • CVE-2025-63000
    26Monitor

    WordPress Sermon Manager plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    wpforchurch · sermon managerDec 31, 2025

  • CVE-2025-69017
    26Monitor

    WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    magnigenie · restropressDec 30, 2025