daroo

20252026

Critical

High

Medium

Low

Global Rank

#33

of 3,213 researchers

Vulns

249

Critical9

High94

Medium145

Low1

Affected Assets

188

184plugins4themes

Avg CVSS

6.2

Average score of vulnerabilities

Researcher Submissions

249 records


2026-07-28 20:38	Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member Fluent Forms <= 6.2.7	`CVE-2026-16655`	7.2 High	daroo	Yes
2026-07-25 12:00	Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field Fluent Forms Pro Add On Pack <= 6.2.6	`CVE-2026-15962`	8.8 High	daroo	Yes
2026-07-22 00:00	Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.18 - Authenticated (Subscriber+) Arbitrary File Deletion Kali Forms <= 2.4.18	`CVE-2026-59542`	8.1 High	daroo	Yes
2026-07-22 00:00	Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization Directory Listings WordPress plugin <= 2.2.0	`CVE-2026-27392`	4.3 Medium	daroo	No
2026-07-22 00:00	Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization Directory Listings WordPress plugin <= 2.2.0	`CVE-2026-27391`	4.3 Medium	daroo	No
2026-07-15 19:43	Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token Uncanny Automator <= 7.3.1.4	`CVE-2026-15008`	8.1 High	daroo	Yes
2026-07-15 06:20	Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter Gravity Forms <= 2.10.4	`CVE-2026-12997`	7.5 High	daroo	Yes
2026-07-10 16:57	WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter WP CTA <= 2.2.2	`CVE-2026-4661`	7.5 High	daroo	Yes
2026-07-10 13:43	WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter WP Ultimate CSV Importer <= 8.0.1	`CVE-2026-13353`	8.8 High	daroo	Yes
2026-07-10 00:00	FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.8 - Unauthenticated Stored Cross-Site Scripting FunnelKit <= 3.15.0.8	`CVE-2026-57816`	7.2 High	daroo	Yes

Showing 1–10 of 249 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C