← All credits
Angus Girvan
42 vulnerability records and advisories credit this contributor.
CVE-2026-1921
Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter
CVE-2026-3464
WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
CVE-2025-14364
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
CVE-2025-11922
Inactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
CVE-2025-13377
10Web Booster <= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache
CVE-2025-12846
Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
CVE-2025-11727
Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
CVE-2025-14388
PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection
CVE-2025-13773
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
CVE-2026-2592
Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update