← All credits
WPScan
3930 vulnerability records and advisories credit this contributor.
CVE-2026-14325
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
CVE-2026-16962
Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation
CVE-2026-13736
NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API
CVE-2026-15046
LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF
CVE-2026-15150
myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED
CVE-2026-16650
Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass
CVE-2026-17559
Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass
CVE-2026-18356
Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
CVE-2026-19848
ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name