← All credits
WPScan
4077 vulnerability records and advisories credit this contributor.
CVE-2026-10755
All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration
CVE-2026-11349
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
CVE-2026-11868
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
CVE-2026-12592
SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header
CVE-2026-13147
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
CVE-2026-13156
MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
CVE-2026-13432
ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation
CVE-2026-8825
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
CVE-2026-9833
Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter
CVE-2026-10525
NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission