← All credits
daroo
79 vulnerability records and advisories credit this contributor.
CVE-2026-104798
My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
CVE-2026-93953
Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
CVE-2026-107768
TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
CVE-2026-97640
WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
CVE-2026-100106
FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
CVE-2026-107742
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
CVE-2026-100107
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
CVE-2026-97338
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
CVE-2026-92820
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
CVE-2026-84925
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter