← All credits
Michael Mazzolini
119 vulnerability records and advisories credit this contributor.
CVE-2025-9321
WPCasa <= 1.4.1 - Unauthenticated Code Injection
CVE-2024-13689
Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias
CVE-2024-10400
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
CVE-2025-4203
wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
CVE-2025-6975
Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
CVE-2024-13695
Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id
CVE-2025-7359
Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block
CVE-2025-12957
All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass
CVE-2025-5570
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
CVE-2024-12428
WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection