← All credits
WPScan
4602 vulnerability records and advisories credit this contributor.
CVE-2026-13147
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
CVE-2026-13156
MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
CVE-2026-13432
ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation
CVE-2026-8825
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
CVE-2026-9833
Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter
CVE-2026-10525
NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission
CVE-2026-11961
User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID
CVE-2026-11575
PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback
CVE-2026-11966
User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler
CVE-2026-12393
WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR