← All credits
and Iñigo Sánchez Enciso
10 vulnerability records and advisories credit this contributor.
CVE-2026-87764
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
CVE-2026-86798
HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
CVE-2026-94274
YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API
CVE-2026-93000
SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
CVE-2026-88788
Text Styler <= 1.1.1 - Contributor+ Stored XSS
CVE-2026-92404
MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure
CVE-2026-88792
Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
CVE-2026-87786
Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
CVE-2026-18395
Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
CVE-2026-19053
ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter