← All credits
WPScan
3987 vulnerability records and advisories credit this contributor.
CVE-2025-8945
Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API
CVE-2025-9314
Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload
CVE-2026-2811
Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection
CVE-2026-82183
OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion
CVE-2026-82182
WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation
CVE-2025-15663
BEAF < 4.7.19 - Author+ Stored XSS via After Label
CVE-2025-15664
BEAF < 4.7.19 - Author+ Stored XSS via Before Label
CVE-2026-12526
Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
CVE-2026-12865
Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters
CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger