← All credits
WPScan
3994 vulnerability records and advisories credit this contributor.
CVE-2026-14239
Tourmaster < 5.4.8 - Stored XSS via CSRF
CVE-2026-16060
Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload
CVE-2026-12586
Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
CVE-2026-14817
Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
CVE-2026-16042
LWS Optimize < 3.4 - Subscriber+ Cache Deletion
CVE-2026-16291
ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
CVE-2026-16292
Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF
CVE-2026-16062
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content
CVE-2026-16057
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
CVE-2026-16274
Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts