← All credits
WPScan
4165 vulnerability records and advisories credit this contributor.
CVE-2026-5336
Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
CVE-2026-11976
MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise
CVE-2026-10599
Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse
CVE-2026-11361
Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status
CVE-2026-3430
Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
CVE-2026-16054
Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
CVE-2026-15246
RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass
CVE-2026-13703
SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure
CVE-2026-14204
Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF
CVE-2026-16746
MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint