← All credits
Erwan LR (WPScan)
172 vulnerability records and advisories credit this contributor.
CVE-2026-78472
Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter
CVE-2026-18232
WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow
CVE-2026-18042
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
CVE-2026-80340
Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
CVE-2026-82923
AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes
CVE-2026-74853
Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
CVE-2026-81571
Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter
CVE-2026-19116
WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
CVE-2026-81807
Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
CVE-2026-17520
Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key