← All credits
Michael Mazzolini
119 vulnerability records and advisories credit this contributor.
CVE-2025-7670
JS Archive List <= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function
CVE-2025-2224
Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing
CVE-2025-5673
Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter
CVE-2024-13693
Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php
CVE-2025-8420
Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution
CVE-2024-11977
kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution
CVE-2025-7443
BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload
CVE-2025-13069
Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass
CVE-2024-13495
GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
CVE-2024-12238
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution