← All credits
WPScan
4600 vulnerability records and advisories credit this contributor.
CVE-2026-109931
Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
CVE-2026-109987
PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
CVE-2026-110010
MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
CVE-2026-110011
MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export
CVE-2026-111958
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
CVE-2026-111971
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
CVE-2026-111972
Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
CVE-2026-78392
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
CVE-2026-88849
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
CVE-2026-97328
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser