← All credits
Hao Ngo
6 vulnerability records and advisories credit this contributor.
CVE-2026-120534
Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
CVE-2026-103039
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
CVE-2026-12227
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
CVE-2026-10821
Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
CVE-2026-5934
WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
CVE-2026-6279
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler