Patchstack

Patchstack is a security researcher credited with 12 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #420 of 3,878 contributors. Their disclosures were published between 2019 and 2026. The most productive year was 2023, with 5 findings.

Their research concentrates on Missing Authorization, which accounts for 7 of their findings (58%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting. The average CVSS score across these disclosures is 7.1, peaking at 9.8. Severity breakdown: 1 critical and 3 high.

The most affected software includes MailerLite (2), MainWP Article Uploader Extension (2), Virtue Premium (2), across 9 distinct plugins, themes and core versions in total.

All 12 disclosed issues have since received a vendor fix. The most severe finding, "MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection", scores 9.8 out of 10.

20192020202120222023202420252026

Critical

High

Medium

Low

Global Rank

#420

of 3,878 researchers

Vulns

Critical1

High3

Medium8

Low0

Affected Assets

25plugins1theme

Avg CVSS

7.1

Average score of vulnerabilities

Researcher Submissions

12 records


2026-09-30 00:00	Virtue Premium <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting Virtue Premium <= 4.10.21	`N/A`	6.4 Medium	Patchstack	Yes
2026-09-30 00:00	Virtue Premium <= 4.10.22 - Authenticated (Contributor+) Stored Cross-Site Scripting Virtue Premium <= 4.10.22	`N/A`	6.4 Medium	Patchstack	Yes
2023-01-18 00:00	MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary File Deletion MainWP Article Uploader Extension <= 4.0.2	`N/A`	8.1 High	Patchstack	Yes
2023-01-18 00:00	MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary Plugin Installation MainWP Favorites Extension <= 4.0.10	`N/A`	6.5 Medium	Patchstack	Yes
2023-01-18 00:00	MainWP UpdraftPlus Extension <= 4.0.6 - Missing Authorization MainWP UpdraftPlus Extension <= 4.0.6	`N/A`	6.5 Medium	Patchstack	Yes
2023-01-18 00:00	MainWP (Various extensions) - Cross-Site Request Forgery MainWP Wordfence Extension <= 4.0.7	`N/A`	8.8 High	Patchstack	Yes
2023-01-18 00:00	MainWP (Various extensions) - Missing Authorization to Arbitrary Page/Post Deletion MainWP Article Uploader Extension 4.0.2	`N/A`	8.1 High	Patchstack	Yes
2021-01-28 00:00	Popup Builder <= 3.72 Missing Authorization on AJAX actions Popup Builder <= 3.71	`N/A`	6.3 Medium	Patchstack	Yes
2020-08-20 00:00	Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization Discount Rules for WooCommerce <= 2.0.2	`CVE-2020-36834`	6.3 Medium	Patchstack	Yes
2020-05-22 00:00	MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection MailerLite < 1.4.4	`N/A`	9.8 Critical	Patchstack	Yes

Showing 1–10 of 12 reports