← All credits
Nabil Irawan
122 vulnerability records and advisories credit this contributor.
CVE-2026-6235
Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests
CVE-2026-15018
Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
CVE-2025-14469
Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification
CVE-2025-5932
Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update
CVE-2026-12741
WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
CVE-2026-15293
WP Business Intelligence Lite <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification
CVE-2026-13347
Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter
CVE-2026-4653
Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter
CVE-2026-14244
Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter
CVE-2026-9842
Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities