← All credits
Muhammad Yudha - DJ
353 vulnerability records and advisories credit this contributor.
CVE-2026-1885
Slideshow Wp <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute
CVE-2025-14000
Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
CVE-2025-15019
BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2025-14835
WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
CVE-2026-0867
Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
CVE-2025-9496
Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode
CVE-2025-7650
BizCalendar Web <= 1.1.0.53 - Authenticated (Contributor+) Local File Inclusion
CVE-2026-0916
Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode
CVE-2025-4172
VerticalResponse Newsletter Widget <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2026-2355
My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes