Adrien Brunner

Adrien Brunner is a security researcher credited with 21 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #267 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 19 of their findings (90%). Other recurring categories include PHP Remote File Inclusion, SQL Injection. The average CVSS score across these disclosures is 6.9, peaking at 7.5. Severity breakdown: 0 critical and 14 high.

The most affected software includes SupportCandy (2), BA Book Everything (1), Better Messages (1), across 20 distinct plugins, themes and core versions in total.

All 21 disclosed issues have since received a vendor fix.

2026

Critical

High

Medium

Low

Global Rank

#267

of 3,823 researchers

Vulns

Critical0

High14

Medium7

Low0

Affected Assets

20plugins

Avg CVSS

6.9

Average score of vulnerabilities

Researcher Submissions

21 records


2026-10-15 15:31	RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL RSS Aggregator by Feedzy <= 5.2.11	`CVE-2026-109207`	7.2 High	Adrien Brunner	Yes
2026-10-13 19:22	LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes LifterLMS <= 10.3.1	`CVE-2026-110284`	7.5 High	Adrien Brunner	Yes
2026-10-13 19:15	GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title GeoDirectory <= 2.8.190	`CVE-2026-107650`	6.4 Medium	Adrien Brunner	Yes
2026-10-09 19:43	HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form HivePress <= 1.7.31	`CVE-2026-107657`	7.2 High	Adrien Brunner	Yes
2026-10-09 17:46	Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment Payment Plugins for Stripe WooCommerce <= 4.0.17	`CVE-2026-89100`	6.1 Medium	Adrien Brunner	Yes
2026-10-09 17:46	Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter Photo Reviews for WooCommerce <= 1.2.30	`CVE-2026-100161`	7.2 High	Adrien Brunner	Yes
2026-10-05 16:28	Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log) Post SMTP <= 4.0.1	`CVE-2026-75962`	7.2 High	Adrien Brunner	Yes
2026-10-02 17:38	Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message Mail logging & Catcher <= 2.1.12	`CVE-2026-93889`	7.2 High	Adrien Brunner	Yes
2026-10-02 17:22	SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name SEOPress <= 10.2	`CVE-2026-96564`	7.2 High	Adrien Brunner	Yes
2026-10-02 14:16	SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter SupportCandy <= 3.5.3	`CVE-2026-94378`	6.4 Medium	Adrien Brunner	Yes

Showing 1–10 of 21 reports