← All credits
WPScan
3994 vulnerability records and advisories credit this contributor.
CVE-2026-16273
Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta
CVE-2026-16261
Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover
CVE-2026-15241
ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
CVE-2026-15206
SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
CVE-2026-15151
Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
CVE-2026-14864
JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
CVE-2026-15385
RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
CVE-2026-14841
King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
CVE-2026-15236
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
CVE-2026-15260
Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR