← All credits
Alex Thomas
79 vulnerability records and advisories credit this contributor.
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
CVE-2026-76581
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
CVE-2025-1794
AM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
CVE-2023-3087
FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject
CVE-2023-5076
Ziteboard Online Whiteboard <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode
CVE-2023-3081
WP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email
CVE-2023-5099
HTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode
CVE-2023-2173
BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion
CVE-2023-5385
Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication