← All credits
Yuto Hyakumoto
11 vulnerability records and advisories credit this contributor.
CVE-2026-16495
Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
CVE-2026-92538
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
CVE-2026-97641
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE-2026-93756
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
CVE-2026-19902
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
CVE-2026-96766
GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
CVE-2026-92561
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
CVE-2026-90981
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
CVE-2026-18561
Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
CVE-2026-7804
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter