kr0d

kr0d is a security researcher credited with 117 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #64 of 3,515 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2025, with 104 findings.

Their research concentrates on Missing Authorization, which accounts for 46 of their findings (39%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, Improper Authorization. The average CVSS score across these disclosures is 8.2, peaking at 10.0. Severity breakdown: 36 critical and 53 high.

The most affected software includes Flynax Bridge (4), IDonate (4), KiotViet Sync (4), across 96 distinct plugins, themes and core versions in total.

80 of the 117 disclosed issues have a vendor fix, while 37 remain unpatched. The most severe finding, "TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover", scores 10.0 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

#64

of 3,515 researchers

Vulns

117

Critical36

High53

Medium27

Low1

Affected Assets

96plugins

Avg CVSS

8.2

Average score of vulnerabilities

Researcher Submissions

117 records


2026-07-28 19:51	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation Spreadsheet Price Changer… <= 2.4.37	`CVE-2025-10656`	9.8 Critical	kr0d	No
2026-02-18 16:32	IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function IDonate 2.1.5 – 2.1.9	`CVE-2025-4521`	8.8 High	kr0d	Yes
2026-02-18 00:00	Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation Tablesome Table 0.5.4 – 1.2.1	`CVE-2025-12845`	8.8 High	kr0d	Yes
2026-02-18 00:00	MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure MP3 Audio Player 4.0 – 5.10	`CVE-2026-1219`	5.3 Medium	kr0d	Yes
2026-02-17 16:14	Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter Frontend Post Submission Manager Lite 1.0.0 – 1.2.7	`CVE-2026-1296`	6.1 Medium	kr0d	Yes
2026-02-13 20:09	MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery MP3 Audio Player 5.3 – 5.10	`CVE-2026-1249`	5.0 Medium	kr0d	Yes
2026-01-27 21:31	Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.15 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover Search Atlas SEO 2.4.4 – 2.5.15	`CVE-2025-14386`	8.8 High	kr0d	Yes
2026-01-23 19:29	All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update All-in-One Video Gallery 4.1.0 – 4.6.4	`CVE-2025-15516`	4.3 Medium	kr0d	Yes
2026-01-15 00:30	AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings AffiliateX 1.0.0 – 1.3.9.3	`CVE-2025-13859`	6.4 Medium	kr0d	Yes
2026-01-05 18:53	GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure GamiPress <= 7.6.1	`CVE-2025-13812`	4.3 Medium	kr0d	Yes

Showing 1–10 of 117 reports