Jakub Herman

Jakub Herman is a security researcher credited with 106 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #70 of 3,515 contributors. The disclosure was published in 2026.

Their research concentrates on Missing Authorization, which accounts for 36 of their findings (34%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Code Injection. The average CVSS score across these disclosures is 6.1, peaking at 9.8. Severity breakdown: 7 critical and 31 high.

The most affected software includes Kirki (4), Events Manager (3), Forminator Forms (2), across 98 distinct plugins, themes and core versions in total.

99 of the 106 disclosed issues have a vendor fix, while 7 remain unpatched. The most severe finding, "JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#70

of 3,515 researchers

Vulns

106

Critical7

High31

Medium68

Low0

Affected Assets

100

100plugins

Avg CVSS

6.1

Average score of vulnerabilities

Researcher Submissions

106 records


2026-09-08 00:00	SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.7.0 - Unauthorized WordPress Account Creation SureCart < 4.7.0	`CVE-2026-75793`	5.3 Medium	Jakub Herman	Yes
2026-09-08 00:00	Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Stored Cross-Site Scripting Kirki 6.2.1 – 6.2.5	`CVE-2026-84219`	7.2 High	Jakub Herman	Yes
2026-09-07 00:00	SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.6.3 - Authenticated (Subscriber+) Arbitrary Account Email Takeover SureCart < 4.6.3	`CVE-2026-18480`	8.8 High	Jakub Herman	Yes
2026-09-07 00:00	JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Information Exposure JetFormBuilder < 3.6.5.2	`CVE-2026-19858`	5.3 Medium	Jakub Herman	Yes
2026-09-04 00:00	Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals \| Critical CSS \| Minify CSS \| Defer CSS Javascript \| CDN < 3.21.2 - Authenticated (Administrator+) Remote Code Execution Hummingbird Performance < 3.21.2	`CVE-2026-19224`	7.2 High	Jakub Herman	Yes
2026-09-04 00:00	Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution Ninja Forms 3.14.10 – 3.15.1	`CVE-2026-80437`	6.5 Medium	Jakub Herman	Yes
2026-09-03 00:00	Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation Advanced Custom Fields 0.9.2.2 – 0.9.2.6	`CVE-2026-80467`	7.3 High	Jakub Herman	Yes
2026-09-03 00:00	Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution Redirection for Contact Form 7 2.2.7 – 3.2.10	`CVE-2026-80439`	6.5 Medium	Jakub Herman	Yes
2026-09-03 00:00	Theme My Login 7.0 - 7.1.15 - Authenticated (Subscriber+) Privilege Escalation Theme My Login 7.0 – 7.1.15	`CVE-2026-81583`	6.3 Medium	Jakub Herman	Yes
2026-09-03 00:00	JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution JetFormBuilder < 3.6.5.2	`CVE-2026-19859`	9.8 Critical	Jakub Herman	Yes

Showing 1–10 of 106 reports