Alex Concha

Alex Concha is a security researcher credited with 11 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #454 of 3,878 contributors. Their disclosures were published between 2007 and 2026. The most productive year was 2022, with 4 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 4 of their findings (36%). Other recurring categories include Deserialization Of Untrusted Data, Exposure Of Data Element To Wrong Session. The average CVSS score across these disclosures is 6.7, peaking at 9.8. Severity breakdown: 1 critical and 4 high.

The most affected software includes WordPress 6.0 (4), WordPress 5.5 (2), My Account Page Editor (1), across 7 distinct plugins, themes and core versions in total.

All 11 disclosed issues have since received a vendor fix. The most severe finding, "WordPress Core < 5.5.3 - PHP Object Injection Gadget", scores 9.8 out of 10.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Global Rank

#454

of 3,878 researchers

Vulns

Critical1

High4

Medium4

Low2

Affected Assets

3plugins5core versions

Avg CVSS

6.7

Average score of vulnerabilities

Researcher Submissions

11 records


2026-10-07 00:00	WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type WordPress 7.1 4.7.0 – 7.1.2 · 25 branches	`N/A`	3.3 Low	Alex Concha	Yes
2024-06-24 00:00	WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API WordPress 6.5 5.9 – 6.5.4 · 7 branches	`CVE-2024-6307`	6.4 Medium	Alex Concha	Yes
2023-09-07 00:00	My Account Page Editor <= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload My Account Page Editor <= 1.3.1	`CVE-2023-4536`	8.8 High	Alex Concha	Yes
2022-10-18 00:00	WordPress Core < 6.0.3 - Shared User Instance Weakness WordPress 6.0 3.6.1 – 6.0.2 · 25 branches	`N/A`	3.7 Low	Ben Bidner	Yes
2022-10-18 00:00	WordPress Core < 6.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Customizer WordPress 6.0 3.6.1 – 6.0.2 · 25 branches	`N/A`	5.5 Medium	Alex Concha	Yes
2022-10-18 00:00	WordPress Core < 6.0.3 & Gutenberg < 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks WordPress 6.0 3.6.1 – 6.0.2 · 25 branches	`CVE-2022-43500`	6.4 Medium	Alex Concha	Yes
2022-10-18 00:00	WordPress Core < 6.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Comments WordPress 6.0 3.6.1 – 6.0.2 · 25 branches	`N/A`	5.5 Medium	Alex Concha	Yes
2020-10-29 00:00	WordPress Core < 5.5.2 - Deserialization Gadget WordPress 5.5 3.7 – 5.5.1 · 20 branches	`CVE-2020-28032`	8.8 High	Alex Concha	Yes
2020-10-29 00:00	WordPress Core < 5.5.3 - PHP Object Injection Gadget WordPress 5.5 3.7 – < 5.5.3 · 20 branches	`CVE-2021-29476`	9.8 Critical	Alex Concha	Yes
2014-08-06 00:00	WordPress Core < 3.9.2 - Deserialization via Widgets WordPress 3.9 3.7 – 3.9.1 · 4 branches	`CVE-2014-5203`	7.2 High	Alex Concha	Yes

Showing 1–10 of 11 reports