← All credits
Drew Webber
33 vulnerability records and advisories credit this contributor.
CVE-2026-2470
Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
CVE-2026-6448
Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
CVE-2026-4031
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception
CVE-2026-4030
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion
CVE-2026-4029
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export
CVE-2026-6670
Media Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters
CVE-2026-2892
Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
CVE-2025-15018
Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover
CVE-2026-2442
Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
CVE-2025-14998
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover