← All credits
Matthew Rollings
300 vulnerability records and advisories credit this contributor.
CVE-2024-7415
Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure
CVE-2024-6835
Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
CVE-2024-6547
Add Admin CSS <= 2.0.1 - Unauthenticated Full Path Dislcosure
CVE-2025-15386
Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSS
CVE-2025-9710
Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
CVE-2025-11241
Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2025-9512
Schema & Structured Data for WP & AMP < 1.50 - Unauthenticated Stored-XSS
CVE-2025-3488
WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode
CVE-2025-0613
Photo Gallery < 1.8.34 - Unauthenticated Stored XSS
CVE-2024-4439
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contri