← All credits
Wordfence Argus
9 vulnerability records and advisories credit this contributor.
CVE-2026-97670
Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
CVE-2026-81929
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
CVE-2026-39919
Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter
CVE-2026-78175
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
CVE-2026-78159
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
CVE-2026-76581
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write