← All credits
Yuto Hyakumoto
15 vulnerability records and advisories credit this contributor.
CVE-2026-76877
WPML Multilingual CMS <= 4.9.7 - Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter
CVE-2026-120538
Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
CVE-2026-116535
SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
CVE-2026-91152
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
CVE-2026-16495
Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
CVE-2026-19902
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
CVE-2026-97641
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE-2026-93756
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
CVE-2026-92538
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
CVE-2026-96766
GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter