← All credits
Jakub Herman
105 vulnerability records and advisories credit this contributor.
CVE-2026-84219
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
CVE-2026-19859
JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter
CVE-2026-80439
Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags
CVE-2026-80437
Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags
CVE-2026-19858
JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
CVE-2026-19224
Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
CVE-2026-16253
Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret
CVE-2026-19453
JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection
CVE-2026-19704
Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi
CVE-2026-80467
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action