Skip to content

Latest research: Read the advisory

Proof, published.

We don't just claim skill. It's in the public record: 200+ CVEs and counting.

  • 4 Critical
  • 13 High
  • 232 Medium

249 CVEs on public record, credited to @ancorn_, @taidh, @p3tl0v3r

249 / 249 shown

CVEVendor / PlatformTypePublishedSeverityRecord
CVE-2024-32511Simple Registration for WooCommerceUnauthenticated Privilege EscalationApr 15, 2024Critical 9.8Advisory
CVE-2024-24842Knowledge Base for Documentation, FAQs with AI AssistanceUnauthenticated PHP Object Injection in is_article_recently_viewedFeb 2, 2024Critical 9.8Advisory
CVE-2022-29317Simple Bus Ticket Booking SystemUnauthenticated SQL Injection via username and password parametersMay 11, 2022Critical 9.8NVD
CVE-2024-31237s2MemberLimited Privilege EscalationApr 5, 2024Critical 9.1Advisory
CVE-2025-32160EventONAuthenticated (Contributor+) Local File InclusionApr 4, 2025High 8.8Advisory
CVE-2024-53824All Bootstrap BlocksAuthenticated (Contributor+) Local File InclusionDec 2, 2024High 8.8Advisory
CVE-2024-37455Ultimate Addons for ElementorAuthenticated (Contributor+) Privilege EscalationJul 1, 2024High 8.8Advisory
CVE-2024-4670All-in-One Video GalleryAuthenticated (Contributor+) Local File Inclusion via aiovg_search_form ShortcodeMay 14, 2024High 8.8Advisory
CVE-2024-3828Spectra ProAuthenticated (Author+) Privilege EscalationMay 9, 2024High 8.8Advisory
CVE-2024-3018Essential Addons for ElementorAuthenticated (Author+) PHP Object Injection via error_resetpasswordMar 29, 2024High 8.8Advisory
CVE-2024-24796Event Manager and Tickets Selling Plugin for WooCommerce – WpEventlyAuthenticated (Contributor+) PHP Object Injection in mep_event_meta_saveJan 31, 2024High 8.8Advisory
CVE-2023-52204RandomizeAuthenticated (Contributor+) SQL InjectionJan 3, 2024High 8.8Advisory
CVE-2023-50841BookingPressAuthenticated (Contributor+) SQL InjectionDec 21, 2023High 8.8Advisory
CVE-2023-50840Booking ManagerAuthenticated(Contributor+) SQL Injection via ShortcodeDec 21, 2023High 8.8Advisory
CVE-2024-4404ElementsKit PROAuthenticated (Contributor+) Server-Side Request ForgeryJun 13, 2024High 8.5Advisory
CVE-2025-39518BMA Lite – Appointment Booking and SchedulingAuthenticated (Admin+) SQL InjectionApr 16, 2025High 7.6Advisory
CVE-2023-4308User Submitted PostsUnauthenticated Stored Cross-Site Scripting via 'user-submitted-content'Aug 14, 2023High 7.2Advisory
CVE-2023-52188Footer PutterAuthenticated (Contributor+) Stored Cross-Site ScriptingJan 3, 2024Medium 6.5Advisory
CVE-2025-32195Ecwid Shopping CartAuthenticated (Contributor+) Stored Cross-Site ScriptingApr 4, 2025Medium 6.4Advisory
CVE-2024-47363BlockspareAuthenticated (Contributor+) Stored Cross-Site ScriptingSep 30, 2024Medium 6.4Advisory
CVE-2024-43934Collapsing ArchivesAuthenticated (Contributor+) Stored Cross-Site ScriptingAug 26, 2024Medium 6.4Advisory
CVE-2024-43935Delicious Recipes – WordPress Recipe PluginAuthenticated (Contributor+) Stored Cross-Site ScriptingAug 26, 2024Medium 6.4Advisory
CVE-2024-43964DSGVO All in one for WPAuthenticated (Contributor+) Stored Cross-Site ScriptingAug 26, 2024Medium 6.4Advisory
CVE-2024-5583The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerceAuthenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget SettingsAug 21, 2024Medium 6.4Advisory
CVE-2024-43349All Bootstrap BlocksAuthenticated (Contributor+) Stored Cross-Site ScriptingAug 16, 2024Medium 6.4Advisory
CVE-2024-43305Custom Layouts – Post + Product grids made easyAuthenticated (Contributor+) Stored Cross-Site ScriptingAug 16, 2024Medium 6.4Advisory
CVE-2024-43278Meta Field BlockAuthenticated (Contributor+) Stored Cross-Site ScriptingAug 16, 2024Medium 6.4Advisory
CVE-2024-4360Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)Authenticated (Contributor+) Stored Cross-Site Scripting via title_tagAug 8, 2024Medium 6.4Advisory
CVE-2024-43164BlockspareAuthenticated (Contributor+) Stored Cross-Site ScriptingAug 7, 2024Medium 6.4Advisory
CVE-2024-3827Spectra ProAuthenticated (Contributor+) Stored Cross-Site Scripting via Block IDsAug 1, 2024Medium 6.4Advisory
CVE-2024-5901SiteOrigin Widgets BundleAuthenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widgetJul 30, 2024Medium 6.4Advisory
CVE-2024-35761vCita Online Booking & Scheduling CalendarAuthenticated (Contributor+) Stored Cross-Site ScriptingJul 17, 2024Medium 6.4Advisory
CVE-2024-38675Arkhe BlocksAuthenticated (Contributor+) Stored Cross-Site ScriptingJul 10, 2024Medium 6.4Advisory
CVE-2024-37948Caxton – Create Pro page layouts in GutenbergAuthenticated (Contributor+) Stored Cross-Site ScriptingJul 10, 2024Medium 6.4Advisory
CVE-2024-3563Genesis BlocksAuthenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block AttributesJul 8, 2024Medium 6.4Advisory
CVE-2024-3639Elementor Addons by LivemeshAuthenticated (Contributor+) Stored Cross-Site Scripting via Posts GridJul 3, 2024Medium 6.4Advisory
CVE-2024-4983The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site ScriptingSee advisoryJun 26, 2024Medium 6.4Advisory
CVE-2024-4569Elementor Addon ElementsAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 26, 2024Medium 6.4Advisory
CVE-2024-37100Elegant Themes IconsAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 20, 2024Medium 6.4Advisory
CVE-2024-35774DImage 360Authenticated (Contributor+) Stored Cross-Site ScriptingJun 18, 2024Medium 6.4Advisory
CVE-2024-5533DiviAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 17, 2024Medium 6.4Advisory
CVE-2024-35764Church AdminAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 17, 2024Medium 6.4Advisory
CVE-2024-2695Shariff WrapperAuthenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeJun 14, 2024Medium 6.4Advisory
CVE-2024-3925Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)Authenticated (Contributor+) Stored Cross-Site Scripting via onclick eventsJun 11, 2024Medium 6.4Advisory
CVE-2024-5090SiteOrigin Widgets BundleAuthenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog WidgetJun 10, 2024Medium 6.4Advisory
CVE-2024-35704BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template LibraryAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 6, 2024Medium 6.4Advisory
CVE-2024-35705Block for Font AwesomeAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 6, 2024Medium 6.4Advisory
CVE-2024-4488Royal Elementor Addons and TemplatesAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 6, 2024Medium 6.4Advisory
CVE-2024-4451Colibri Page BuilderAuthenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player ShortcodeJun 6, 2024Medium 6.4Advisory
CVE-2024-1988Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo BlocksAuthenticated (Contributor+) Stored Cross-Site ScriptingJun 6, 2024Medium 6.4Advisory

50 of 249 shown