← All credits
Michael Mazzolini
119 vulnerability records and advisories credit this contributor.
CVE-2025-2008
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload
CVE-2024-13453
Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution
CVE-2025-7441
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
CVE-2024-13345
Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution
CVE-2024-11260
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter
CVE-2025-0764
wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
CVE-2025-2186
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'
CVE-2025-9322
Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection
CVE-2025-2075
Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
CVE-2025-2299
LuckyWP Table of Contents <= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting