← All credits
Matthew Rollings
300 vulnerability records and advisories credit this contributor.
CVE-2024-4486
Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget
CVE-2024-5345
Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion
CVE-2024-6559
XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure
CVE-2024-7415
Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure
CVE-2024-6835
Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
CVE-2024-6547
Add Admin CSS <= 2.0.1 - Unauthenticated Full Path Dislcosure
CVE-2025-15386
Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSS
CVE-2025-3488
WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode
CVE-2025-0613
Photo Gallery < 1.8.34 - Unauthenticated Stored XSS
CVE-2024-4439
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contri