Administrator Z
Administrator Z has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; 5 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 4 disclosures.
The most common weakness is Missing Authorization, behind 2 of the records (33%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.
5 of the records (83%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
5 independent researchers contributed these findings, one record each. Administrator Z is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-32187Administrator Z <= 2025.09.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Administrator Z
Author
Quý Lê 91
Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt. Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem. Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit laboriosam, nisi ut aliquid ex ea commodi consequatur? Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse quam nihil molestiae consequatur, vel illum qui dolorem eum fugiat quo voluptas nulla pariatur? Wordfence code: cki2dia7unnr9q1usvkozrauspcjrnaq
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C