kr0d

202420252026

Critical

High

Medium

Low

Global Rank

#63

of 3,238 researchers

Vulns

117

Critical36

High53

Medium27

Low1

Affected Assets

96

96plugins

Avg CVSS

8.2

Average score of vulnerabilities

Researcher Submissions

116 records


2026-02-18 16:32	IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function IDonate 2.1.5 – 2.1.9	`CVE-2025-4521`	8.8 High	kr0d	Yes
2026-02-18 00:00	Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation Tablesome Table 0.5.4 – 1.2.1	`CVE-2025-12845`	8.8 High	kr0d	Yes
2026-02-18 00:00	MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure MP3 Audio Player 4.0 – 5.10	`CVE-2026-1219`	5.3 Medium	kr0d	Yes
2026-02-17 16:14	Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter Frontend Post Submission Manager Lite 1.0.0 – 1.2.7	`CVE-2026-1296`	6.1 Medium	kr0d	Yes
2026-02-13 20:09	MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery MP3 Audio Player 5.3 – 5.10	`CVE-2026-1249`	5.0 Medium	kr0d	Yes
2026-01-27 21:31	Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.15 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover Search Atlas SEO 2.4.4 – 2.5.15	`CVE-2025-14386`	8.8 High	kr0d	Yes
2026-01-23 19:29	All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update All-in-One Video Gallery 4.1.0 – 4.6.4	`CVE-2025-15516`	4.3 Medium	kr0d	Yes
2026-01-15 00:30	AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings AffiliateX 1.0.0 – 1.3.9.3	`CVE-2025-13859`	6.4 Medium	kr0d	Yes
2026-01-05 18:53	GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure GamiPress <= 7.6.1	`CVE-2025-13812`	4.3 Medium	kr0d	Yes
2025-12-18 18:14	HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery HTML5 Audio Player 2.4.0 – 2.5.1	`CVE-2025-13999`	7.2 High	kr0d	Yes

Showing 1–10 of 116 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C