← All credits
Truoc Phan
38 vulnerability records and advisories credit this contributor.
CVE-2026-12561
tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2025-2890
tagDiv Opt-In Builder <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter
CVE-2024-7503
WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover
CVE-2024-3886
tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]
CVE-2023-3352
Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion
CVE-2024-5212
tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]
CVE-2023-3202
MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update
CVE-2024-7628
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover
CVE-2023-3201
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
CVE-2023-3198
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update