← All credits
Kuba
15 vulnerability records and advisories credit this contributor.
CVE-2026-89427
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
CVE-2026-96567
MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
CVE-2026-102772
CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
CVE-2026-97341
Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
CVE-2026-100152
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
CVE-2026-103888
WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
CVE-2026-89424
Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter
CVE-2026-92244
PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
CVE-2026-92554
ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name