daroo

daroo is a security researcher credited with 331 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #24 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 254 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 85 of their findings (26%). Other recurring categories include Missing Authorization, SQL Injection. The average CVSS score across these disclosures is 6.5, peaking at 9.8. Severity breakdown: 11 critical and 165 high.

The most affected software includes Forminator Forms (10), Avada (Fusion) Builder (4), JetEngine (4), across 244 distinct plugins, themes and core versions in total.

318 of the 331 disclosed issues have a vendor fix, while 13 remain unpatched. The most severe finding, "Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#24

of 3,515 researchers

Vulns

331

Critical11

High165

Medium154

Low1

Affected Assets

245

239plugins6themes

Avg CVSS

6.5

Average score of vulnerabilities

Researcher Submissions

331 records


2026-09-10 20:46	Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter Kirki <= 6.2.0	`CVE-2026-17037`	7.2 High	daroo	Yes
2026-09-10 14:40	UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion UsersWP <= 1.2.70	`CVE-2026-19991`	8.1 High	daroo	Yes
2026-09-10 11:10	AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter AcyMailing <= 11.0.4	`CVE-2026-77807`	7.5 High	daroo	Yes
2026-09-07 12:13	Unlimited Elements For Elementor <= 2.0.17 - Unauthenticated Stored Cross-Site Scripting Unlimited Elements For Elementor <= 2.0.17	`CVE-2026-84820`	7.2 High	daroo	Yes
2026-09-06 00:00	User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field User Profile Builder <= 3.15.7	`CVE-2026-6431`	7.2 High	daroo	Yes
2026-09-04 18:09	SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload SureForms <= 2.12.2	`CVE-2026-18406`	7.2 High	daroo	Yes
2026-09-04 18:06	Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value Gravity Forms <= 2.10.5	`CVE-2026-16649`	7.2 High	daroo	Yes
2026-09-04 17:58	Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback Welcart e-Commerce <= 2.12.1	`CVE-2026-19887`	8.8 High	daroo	Yes
2026-09-04 17:24	iubenda \| All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content iubenda <= 3.13.4	`CVE-2026-77263`	7.2 High	daroo	Yes
2026-09-02 00:00	RTMKit <= 2.1.5 - Authenticated (Contributor+) PHP Object Injection RTMKit <= 2.1.5	`CVE-2026-84752`	7.5 High	daroo	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 331 records. Every record has its own page and is listed in the sitemap.