← All credits
daroo
63 vulnerability records and advisories credit this contributor.
CVE-2026-77807
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
CVE-2026-19991
UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
CVE-2026-17037
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
CVE-2026-6431
User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
CVE-2026-19887
Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
CVE-2026-16649
Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
CVE-2026-77263
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE-2026-18406
SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
CVE-2026-76053
TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
CVE-2026-6176
Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form