daroo

daroo is a security researcher credited with 363 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #22 of 3,899 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 286 findings.

Their research concentrates on Improper Neutralization Of Input During Web Page Generation, which accounts for 105 of their findings (29%). Other recurring categories include Missing Authorization, Improper Neutralization Of Special Elements Used In An SQL Command. The average CVSS score across these disclosures is 6.6, peaking at 9.8. Severity breakdown: 14 critical and 187 high.

The most affected software includes Forminator Forms (10), Avada (Fusion) Builder (4), JetEngine (4), across 264 distinct plugins, themes and core versions in total.

349 of the 363 disclosed issues have a vendor fix, while 14 remain unpatched. The most severe finding, "Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#22

of 3,899 researchers

Vulns

363

Critical14

High187

Medium161

Low1

Affected Assets

265

257plugins8themes

Avg CVSS

6.6

Average score of vulnerabilities

Researcher Submissions

363 records


2026-10-28 17:00	Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler Password Protected <= 2.8.4	`CVE-2026-93293`	6.4 Medium	daroo	Yes
2026-10-27 11:37	Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter Jupiter X Core <= 4.61.0	`CVE-2026-106013`	9.8 Critical	daroo	Yes
2026-10-26 18:03	Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint Kirki <= 6.2.5	`CVE-2026-75891`	8.8 High	daroo	Yes
2026-10-22 16:27	Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter Anti-Spam, Spam FireWall by CleanTalk <= 6.89.1	`CVE-2026-109198`	7.2 High	daroo	Yes
2026-10-16 14:28	LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters LearnPress <= 4.4.10	`CVE-2026-109208`	7.2 High	daroo	Yes
2026-10-15 18:46	FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter FiboSearch <= 1.34.2	`CVE-2026-100106`	6.4 Medium	daroo	Yes
2026-10-15 17:58	TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers TranslatePress <= 3.3.7	`CVE-2026-107768`	7.2 High	daroo	Yes
2026-10-15 17:43	WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) WPConsent <= 1.1.9	`CVE-2026-97640`	7.2 High	daroo	Yes
2026-10-15 16:25	My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute My Calendar 3.4.24 – 3.8.7 · 5 branches	`CVE-2026-104798`	9.8 Critical	daroo	Yes
2026-10-15 15:13	Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation Backuply <= 1.5.8	`CVE-2026-93953`	8.0 High	daroo	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 363 records. Every record has its own page and is listed in the sitemap.