Zero-day vulnerabilities reported in software that thousands of businesses rely on.
I find security vulnerabilities in the WordPress ecosystem and report them through the appropriate disclosure platforms, such as Patchstack and Wordfence, so they are validated, assigned a CVE, and fixed before they can be exploited by bad actors.
That work requires reading production plugin code the way an attacker would, proving a flaw under the lowest level of access an ordinary user can get, and then handling it responsibly: nothing is published until a site owner who reads it can actually fix their site.
Validated vulnerability research in WordPress and WooCommerce software, recorded in the public CVE system.
Reported through recognised disclosure platforms and bug bounty programs, including Patchstack and Wordfence.
Findings at a glance
| CVE | Vulnerability | Who is affected | What to do |
|---|---|---|---|
| CVE-2026-96450 | Stored cross-site scripting (XSS) in pixfort Core | WordPress sites running pixfort Core before 4.3.3. The plugin ships with a theme sold for more than 21,000 sites. | Update pixfort Core to 4.3.3 or later |
| CVE-2026-49779 | Path traversal in Addify Tax Exempt for WooCommerce | WooCommerce stores running the plugin before 1.9.5 | Update to 1.9.5 or later |
The published findings
A short note on terms, for non-technical readers: a CVE is the public, numbered record of a confirmed vulnerability. Affected versions are the versions that contain the flaw. Fixed version is the first version that removes it. If your site runs an affected version, update to the latest version immediately.
CVE-2026-96450 · STORED CROSS-SITE SCRIPTING
Contributor stored XSS in a plugin shipped to 21,000+ WordPress sites
What happened
In WordPress, a Contributor is a low-trust account. Contributors can write content for review, but they cannot publish it themselves and they are not allowed to add scripts to a site. In pixfort Core, two custom data paths, the global Header builder and Portfolio Text metadata, accepted Contributor content without the cleaning WordPress applies to ordinary post content.
That meant a Contributor could store script-bearing content, and an administrator could review and publish it without seeing anything wrong. The content did nothing during review, but the script would then run in the browser of a visitor to the published site, under that site’s own address and reputation.
Why it matters
Stored XSS is a trust problem as much as a technical one. The harmful content is saved on the site itself and delivered to ordinary visitors as if the site had intended it. For a business, that can mean visitors are redirected, forms are tampered with, or the site’s good name is used to run code the owner never approved. The flaw also bypassed the control that is supposed to make a low-trust role safe: the administrator’s review.
Technical record
Classification: CWE-79, Stored Cross-Site Scripting · Severity: CVSS 3.1, 5.4 (Medium) · Minimum account required: default WordPress Contributor, without the ability to publish or add unfiltered HTML · Validated in pixfort Core 4.3.0
- Affected versions
- Before 4.3.3
- Fixed version
- 4.3.3
- CVE published
CVE-2026-49779 · PATH TRAVERSAL
Zero-day path traversal in Addify Tax Exempt for WooCommerce
What happened
Path traversal is a simple idea with serious consequences: a program is supposed to stay inside one folder, but it can be tricked into reaching files outside that folder. In Addify Tax Exempt for WooCommerce, an authenticated account at customer level (the lowest-privilege account a store creates in normal operation) could access private files stored elsewhere on the server.
This finding was reported through the Patchstack Bug Bounty Program on May 27, 2026, before any advisory, fix, or CVE existed. That is what “zero-day” means here in plain terms: the flaw was found and reported first, and the public record and the fix followed from that report.
Why it matters
A WooCommerce store holds files a business would not want read by a customer account: configuration, order and tax-related material, and other private documents stored on the same server. A reliable way to read files outside the intended folder gives an attacker a starting point and exposes information that should never leave the server. No action by a staff member was required to use this flaw; a customer-level login was enough.
Technical record
Classification: CWE-35, Path Traversal · Severity: CVSS 3.1, 6.5 (Medium) · Minimum account required: authenticated, customer-level · Validated in version 1.9.3
- Affected versions
- Before 1.9.5
- Fixed version
- 1.9.5
- CVE published
UNDER RESPONSIBLE DISCLOSURE
Findings under responsible disclosure.
Finding a vulnerability is only half of the work. Handling it well is what protects the businesses running the software.
Findings in progress are submitted privately through the appropriate disclosure platform, a program such as Patchstack or Wordfence, which validates the report, assigns the CVE, and coordinates the disclosure process. Technical detail is published only after a fix is available. Publishing sooner would help no site owner: it would describe a problem they could not yet fix, and it would give anyone else a head start on using it.
How responsible disclosure works
| Step | What happens |
|---|---|
| 1. Find and validate | A potential flaw is tested in an isolated environment and confirmed, with the exact version and conditions recorded. |
| 2. Report through a platform | The full technical report goes privately to the appropriate disclosure platform or bug bounty program (for example, Patchstack or Wordfence) before anything is public. The platform validates the finding and coordinates disclosure. |
| 3. Fix first | Publication waits until a fixed version exists, so a site owner who reads the disclosure can act on it immediately. |
| 4. Publish clear guidance | The published record states the affected versions and the fixed version, and links to the platform advisory and the official CVE record. |
UNDISCLOSED FINDING
Validated and reported through a disclosure platform.
Under responsible disclosure. Details will be published after a fix is available.
UNDISCLOSED FINDING
Validated and reported through a disclosure platform.
Under responsible disclosure. Details will be published after a fix is available.