← All credits
WPScan
3829 vulnerability records and advisories credit this contributor.
CVE-2026-88824
Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
CVE-2026-88926
VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi
CVE-2026-91847
Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR
CVE-2026-92099
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
CVE-2026-92403
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution
CVE-2026-92404
MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure
CVE-2026-92420
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
CVE-2026-92425
Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
CVE-2026-92430
Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook