← All credits
WPScan
3989 vulnerability records and advisories credit this contributor.
CVE-2026-13154
Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint
CVE-2026-13153
Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint
CVE-2026-12713
WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number
CVE-2025-15678
Nexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload
CVE-2026-16734
Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation
CVE-2026-16290
ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group
CVE-2026-16954
AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
CVE-2026-18050
Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads
CVE-2026-14829
Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret
CVE-2026-14313
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR