← All credits
WPScan
4073 vulnerability records and advisories credit this contributor.
CVE-2026-12695
miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
CVE-2026-12251
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
CVE-2026-12720
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
CVE-2026-12721
Kirki < 6.0.13 - Unauthenticated SQL Injection
CVE-2026-13392
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
CVE-2026-12697
wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
CVE-2026-13609
Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field
CVE-2026-14862
Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization
CVE-2026-14919
ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute
CVE-2026-14317
GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass