← All credits
Jakub Herman
105 vulnerability records and advisories credit this contributor.
CVE-2026-118066
Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter
CVE-2026-19256
All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force
CVE-2026-110813
Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection
CVE-2026-86606
iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
CVE-2026-118166
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag
CVE-2026-108041
SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings
CVE-2026-115262
Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
CVE-2026-114422
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
CVE-2026-116761
CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
CVE-2026-105972
WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute