← All credits
Alex Thomas
79 vulnerability records and advisories credit this contributor.
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
CVE-2026-76581
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
CVE-2025-1794
AM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
CVE-2025-9191
Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search
CVE-2025-9163
Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
CVE-2025-8871
Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
CVE-2025-6673
Easy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode
CVE-2024-3565
Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode
CVE-2024-2544
Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions