← All credits
daroo
58 vulnerability records and advisories credit this contributor.
CVE-2026-5243
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget
CVE-2026-6929
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
CVE-2026-5192
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
CVE-2026-6320
Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
CVE-2026-5231
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
CVE-2026-4758
WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field
CVE-2026-4335
ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field