← All credits
Erwan LR (WPScan)
171 vulnerability records and advisories credit this contributor.
CVE-2026-18232
WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow
CVE-2026-80340
Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
CVE-2026-18042
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
CVE-2026-74853
Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
CVE-2026-82923
AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes
CVE-2026-81807
Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
CVE-2026-81571
Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter
CVE-2026-19116
WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
CVE-2026-76548
Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass
CVE-2026-18234
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet