← All credits
WPScan
4010 vulnerability records and advisories credit this contributor.
CVE-2026-12721
Kirki < 6.0.13 - Unauthenticated SQL Injection
CVE-2026-13392
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
CVE-2026-12697
wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
CVE-2026-13609
Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field
CVE-2026-14862
Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization
CVE-2026-14919
ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute
CVE-2026-14317
GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
CVE-2026-14333
Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory
CVE-2026-14830
FlxWoo < 3.1.1 - Unauthenticated Payment Bypass
CVE-2026-14833
Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute