63n0

63n0 is a security researcher credited with 9 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #489 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2025, with 8 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 6 of their findings (67%). Other recurring categories include Deserialization Of Untrusted Data, Unrestricted Upload Of File With Dangerous Type. The average CVSS score across these disclosures is 6.2, peaking at 7.5. Severity breakdown: 0 critical and 2 high.

The most affected software includes Welcart e-Commerce (2), Contact Form by Supsystic (1), Embed Any Document (1), across 8 distinct plugins, themes and core versions in total.

7 of the 9 disclosed issues have a vendor fix, while 2 remain unpatched.

20242025

Critical

High

Medium

Low

Global Rank

#489

of 3,515 researchers

Vulns

Critical0

High2

Medium7

Low0

Affected Assets

8plugins

Avg CVSS

6.2

Average score of vulnerabilities

Researcher Submissions

9 records


2025-09-26 00:00	Embed Any Document <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Embed Any Document <= 2.7.7	`CVE-2025-60099`	6.4 Medium	63n0	Yes
2025-09-09 00:00	Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting Welcart e-Commerce <= 2.11.20	`CVE-2025-58984`	4.4 Medium	63n0	Yes
2025-09-03 00:00	Tooltipy <= 5.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Tooltipy (tooltips for WP) <= 5.5.6	`CVE-2025-58614`	6.4 Medium	63n0	Yes
2025-08-19 00:00	iFrame Block <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting iFrame Block <= 0.1.1	`CVE-2025-49411`	6.4 Medium	63n0	No
2025-08-18 00:00	Contact Form by Supsystic <= 1.7.36 - Reflected Cross-Site Scripting Contact Form by Supsystic <= 1.7.36	`CVE-2025-52753`	6.1 Medium	63n0	Yes
2025-08-12 00:00	Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection Welcart e-Commerce <= 2.11.16	`CVE-2025-54012`	6.6 Medium	63n0	Yes
2025-08-05 00:00	Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection Groundhogg <= 4.2.2	`CVE-2025-54053`	7.5 High	63n0	Yes
2025-08-05 00:00	Seriously Simple Podcasting <= 3.11.1 - Authenticated (Editor+) Stored Cross-Site Scripting Seriously Simple Podcasting <= 3.11.1	`CVE-2025-49923`	4.4 Medium	63n0	Yes
2024-08-27 00:00	Zippy <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload Zippy <= 1.7.0	`CVE-2025-52758`	7.2 High	63n0	No

Showing 1–9 of 9 reports