vciy

CVEs we hold for David

Records whose assigning authority named David as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-8438All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Pathdavidanderson All-In-One Security (AIOS) – Security and…
CVE-2026-7660Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameterdavidanderson Easy Updates Manager
CVE-2026-7252WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Metadavidanderson WP-Optimize – Cache, Compress images, Minify…
CVE-2026-6710Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Formdavidskysa Skysa Text Ticker App
CVE-2026-66603WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerabilityDavid Artiss Draft List
CVE-2026-66601WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-66600WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-66591WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-6403Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameterdavidfcarr Quick Playground
CVE-2026-61963WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-56012WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-54198WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-5410Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Inputdavidanderson Redux Framework
CVE-2026-5400Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Inputdavidanderson Redux Framework
CVE-2026-5399Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Valuedavidanderson Redux Framework
CVE-2026-48813Flawfinder output manipulation via untrusted filenames and source textdavid-a-wheeler flawfinder
CVE-2026-45091sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)davidalmeidac sealed-env
CVE-2026-35201Discount has an Out-of-bounds Read in rdiscountdavidfstr rdiscount
CVE-2026-34897WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-34885WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-32399WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2026-3140Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivationdavidvongries Ultimate Dashboard – Custom WordPress…
CVE-2026-2712WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image…davidanderson WP-Optimize – Cache, Compress images, Minify…
CVE-2026-2500Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameterdavidfcarr Quick Playground
CVE-2026-1830Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Uploaddavidfcarr Quick Playground
CVE-2026-11702Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processesDAVIDO Bytes::Random::Secure::Tiny
CVE-2026-11625Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processesDAVIDO Bytes::Random::Secure
CVE-2026-10795UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpcdavidanderson UpdraftPlus: WP Backup & Migration Plugin
CVE-2025-9488Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameterdavidanderson Redux Framework
CVE-2025-63065WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2025-59590WordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) VulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2025-58859WordPress Add to Feedly Plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) VulnerabilityDavid Merinas Add to Feedly
CVE-2025-58843WordPress Auto Last Youtube Video Plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) VulnerabilityDavid Merinas Auto Last Youtube Video
CVE-2025-54884Vision UI security-kit.js: Potential Uncontrolled Resource Allocation VulnerabilityDavidOsipov Vision-ui
CVE-2025-54883Vision UI's security-kit Contains Cryptographic WeaknessDavidOsipov Vision-ui
CVE-2025-49972WordPress TM Replace Howdy plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) VulnerabilityDavid Wood TM Replace Howdy
CVE-2025-48278WordPress RSVPMarker plugin <= 11.5.6 - SQL Injection Vulnerabilitydavidfcarr RSVPMarker
CVE-2025-39435WordPress My Marginalia plugin <= 1.0.6 - CSRF to Stored XSS vulnerabilitydavidfcarr My Marginalia
CVE-2025-39419WordPress Revision Diet plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityDavid Miller Revision Diet
CVE-2025-39413WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerabilityDavid Gwyer Simple Sitemap – Create a Responsive HTML…
CVE-2025-31627WordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2025-31621WordPress byBrick Accordion plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitydavidpaulsson byBrick Accordion
CVE-2025-31552WordPress RSVPMarker plugin <= 11.6.7 - SQL Injection vulnerabilitydavidfcarr RSVPMarker
CVE-2025-31437WordPress WP-OGP plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityDavid Miller WP-OGP
CVE-2025-30616WordPress Latest Custom Post Type Updates plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Wood Latest Custom Post Type Updates
CVE-2025-30547WordPress WP Cards plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityDavid Tufts WP Cards
CVE-2025-29780Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix OperationsDavidOsipov PostQuantum-Feldman-VSS
CVE-2025-29779Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in…DavidOsipov PostQuantum-Feldman-VSS
CVE-2025-28950WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) VulnerabilityDavid Shabtai Post Author
CVE-2025-27278WordPress AcuGIS Leaflet Maps Plugin <= 5.1.1.0 - Multiple Cross Site Scripting (XSS) vulnerabilitiesDavid Ghedini AcuGIS Leaflet Maps
CVE-2025-24600WordPress RSVPMaker plugin <= 11.4.5 - Broken Access Control vulnerabilitydavidfcarr RSVPMarker
CVE-2025-23812WordPress Contact Form 7 Round Robin Lead Distribution Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS)…David Jeffrey Contact Form 7 Round Robin Lead Distribution
CVE-2025-23784WordPress Contact Form 7 Round Robin Lead Distribution Plugin <= 1.2.1 - SQL Injection vulnerabilityDavid Jeffrey Contact Form 7 Round Robin Lead Distribution
CVE-2025-23553WordPress Userbase Access Control plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Cramer Userbase Access Control
CVE-2025-23531WordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydavidfcarr RSVPMaker Volunteer Roles
CVE-2025-23449WordPress Simple shortcode buttons plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitydavidpuc Simple shortcode buttons
CVE-2025-23427WordPress Redux Converter plugin <= 1.1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Anderson / Team Updraft Redux Converter
CVE-2025-2276Ultimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules…davidvongries Ultimate Dashboard – Custom WordPress…
CVE-2025-13960GPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesdavidkeen GPXpress
CVE-2025-13847PhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesdavidangel PhotoFade
CVE-2025-11801AudioTube <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingdavidangel AudioTube
CVE-2025-0215UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scriptingdavidanderson UpdraftPlus: WP Backup & Migration Plugin
CVE-2024-6828Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scriptingdavidanderson Redux Framework
CVE-2024-56003WordPress Caldera SMTP Mailer plugin <= 1.0.1 - Broken Access Control vulnerabilityDavid Cramer Caldera SMTP Mailer
CVE-2024-51661WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerabilityDavid Lingren Media LIbrary Assistant
CVE-2024-50533WordPress Domain Sharding plugin <= 1.2.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityDavid Garcia Domain Sharding
CVE-2024-50531WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerabilitydavidfcarr RSVPMaker for Toastmasters
CVE-2024-49677WordPress Bootstrap Buttons plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Cramer Bootstrap Buttons
CVE-2024-44029WordPress Viala theme <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Garlitz viala
CVE-2024-4193Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingdavidanderson Testimonial Slider
CVE-2024-38760WordPress Send Users Email plugin <= 1.5.1 - Sensitive Data Exposure vulnerabilityDavid Maucher Send Users Email
CVE-2024-25904WordPress TinyMCE Professional Formats and Styles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)David Stockl TinyMCE and TinyMCE Advanced Professsional…
CVE-2024-25099WordPress Paytium: Mollie payment forms & donations Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)David de Boer Paytium: Mollie payment forms & donations
CVE-2024-13857WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgerydavidanderson WPGet API – Connect to any external REST API
CVE-2024-10957UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injectiondavidanderson UpdraftPlus: WP Backup & Migration Plugin
CVE-2024-1037All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scriptingdavidanderson All-In-One Security (AIOS) – Security and…
CVE-2024-0657Internal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scriptingdavidanderson Internal Link Juicer: SEO Auto Linker for…
CVE-2024-0621Simple Share Buttons Adder <= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settingsdavidoffneal Simple Share Buttons Adder
CVE-2023-5982UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Updatedavidanderson UpdraftPlus: WP Backup & Migration Plugin
CVE-2023-50828WordPress Ultimate Dashboard Plugin <= 3.7.11 is vulnerable to Cross Site Scripting (XSS)David Vongries Ultimate Dashboard – Custom WordPress…
CVE-2023-49837WordPress embed-code plugin <= 2.3.6 - Denial of Service Attack vulnerabilityDavid Artiss Code Embed
CVE-2023-49822WordPress Ultimate Dashboard plugin <= 3.7.10 - Secret Login Page Location Disclosure on Multisites vulnerabilityDavid Vongries Ultimate Dashboard
CVE-2023-47756WordPress Welcome Email Editor plugin <= 5.0.6 - Broken Access Control vulnerabilityDavid Vongries Welcome Email Editor
CVE-2023-4726Ultimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settingsdavidvongries Ultimate Dashboard – Custom WordPress…
CVE-2023-46636WordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)David Stöckl Custom Header Images
CVE-2023-46632WordPress My Shortcodes plugin <= 2.3 - Broken Access Control vulnerabilityDavid Cramer My Shortcodes
CVE-2023-45269WordPress Simple SEO Plugin <= 2.0.25 is vulnerable to Cross Site Request Forgery (CSRF)David Cole Simple SEO
CVE-2023-41652WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL InjectionDavid F. Carr RSVPMaker
CVE-2023-37973WordPress Replace Word Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)David Pokorny Replace Word
CVE-2023-34010WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)David Lingren Media Library Assistant
CVE-2023-31232WordPress Plugins List Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)David Artiss Plugins List
CVE-2023-29095WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL InjectionDavid F. Carr RSVPMaker
CVE-2023-27617WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS)David F. Carr RSVPMaker
CVE-2023-27616WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS)David F. Carr RSVPMaker
CVE-2023-25054WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE)David F. Carr RSVPMaker
CVE-2023-25047WordPress RSVPMarker Plugin <= 9.9.3 is vulnerable to SQL InjectionDavid F. Carr RSVPMaker
CVE-2023-25045WordPress RSVPMarker Plugin <= 9.9.3 is vulnerable to SQL InjectionDavid F. Carr RSVPMaker
CVE-2023-24401WordPress Mobile Call Now & Map Buttons Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)Davidsword Mobile Call Now & Map Buttons
CVE-2023-24385WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)David Lingren Media Library Assistant
CVE-2023-23883WordPress WP Content Filter – Censor All Offensive Content From Your Site Plugin <= 3.0.1 is vulnerable to Cross Site…David Gwyer WP Content Filter
CVE-2023-23734WordPress Userlike – WordPress Live Chat plugin Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)David Voswinkel Userlike – WordPress Live Chat plugin
CVE-2023-23721WordPress Admin Log Plugin <= 1.50 is vulnerable to Cross Site Request Forgery (CSRF)David Gwyer Admin Log
CVE-2022-44741WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerabilityDavid Anderson Testimonial Slider (WordPress plugin)
CVE-2022-44627WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerabilityDavid Cole Simple SEO (WordPress plugin)
CVE-2022-41618WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerabilityDavid Lingren Media Library Assistant (WordPress plugin)
CVE-2022-4066davidmoreno onion Log response.c onion_response_flush allocation of resourcesdavidmoreno onion
CVE-2022-36404WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerabilityDavid Cole Simple SEO (WordPress plugin)
CVE-2022-1768RSVPMaker <= 9.3.2 - Unauthenticated SQL Injectiondavidfcarr RSVPMaker
CVE-2022-1505RSVPMaker <= 9.2.6 - Unauthenticated SQL Injectiondavidfcarr RSVPMaker
CVE-2022-1453RSVPMaker <= 9.2.5 - Unauthenticated SQL Injectiondavidfcarr RSVPMaker
CVE-2020-3711160CycleCMS 2.5.2 - 'news.php' Cross-site Scripting (XSS) VulnerabilityDavidvg 60CycleCMS
CVE-2020-3711060CycleCMS 2.5.2 - 'news.php' SQL Injection VulnerabilityDavidvg 60CycleCMS
CVE-2019-25709CF Image Hosting Script 1.6.5 Unauthorized Database AccessDavidtavarez CF Image Hosting Script

113 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.