← All credits
WPScan
4253 vulnerability records and advisories credit this contributor.
CVE-2026-10830
AllCoach < 1.0.2 - Unauthenticated Account Takeover
CVE-2026-11766
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
CVE-2026-11855
Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version
CVE-2026-12083
Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter
CVE-2026-6382
Multiple elFinder Plugins - Authenticated OS Command Injection
CVE-2026-11578
Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR
CVE-2026-10077
YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes
CVE-2026-11781
Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX
CVE-2026-11965
User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass
CVE-2026-10750
Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools