← All credits

WPScan

4600 vulnerability records and advisories credit this contributor.

CVE-2026-107127

Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF

CVE-2026-107128

Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization

CVE-2026-107237

Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

CVE-2026-107506

Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting

CVE-2026-107788

SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

CVE-2026-107789

SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

CVE-2026-107790

WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title

CVE-2026-108073

SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter

CVE-2026-109147

WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter

CVE-2026-109926

Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation