Alex Thomas

2023202420252026

Critical

High

Medium

Low

Global Rank

#86

of 3,238 researchers

Vulns

76

Critical0

High20

Medium55

Low1

Affected Assets

50

49plugins1theme

Avg CVSS

5.8

Average score of vulnerabilities

Researcher Submissions

76 records


2026-04-07 17:38	AM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG AM LottiePlayer <= 3.6.0	`CVE-2025-1794`	5.4 Medium	Alex Thomas	No
2025-11-26 00:01	Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search Houzez <= 4.1.6	`CVE-2025-9191`	6.3 Medium	Alex Thomas	Yes
2025-11-26 00:01	Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload Houzez <= 4.1.6	`CVE-2025-9163`	6.1 Medium	Alex Thomas	Yes
2025-11-04 14:21	Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature Everest Forms Pro <= 1.9.7	`CVE-2025-8871`	5.6 Medium	Alex Thomas	Yes
2025-07-03 19:04	Easy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode Easy restaurant menu manager <= 2.0.1	`CVE-2025-6673`	6.4 Medium	Alex Thomas	Yes
2024-08-16 00:00	Radio Player <= 2.0.73 - Missing Authorization to Player Update Radio Player <= 2.0.73	`CVE-2023-4025`	5.3 Medium	Alex Thomas	Yes
2024-08-16 00:00	Radio Player <= 2.0.73 - Missing Authorization to Player Deletion Radio Player <= 2.0.73	`CVE-2023-4024`	5.3 Medium	Alex Thomas	Yes
2024-08-16 00:00	Radio Player <= 2.0.73 - Missing Authorization to Settings Update Radio Player <= 2.0.73	`CVE-2023-4027`	5.3 Medium	Alex Thomas	Yes
2024-06-14 00:00	Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions Popup Builder <= 4.3.0	`CVE-2024-2544`	7.4 High	Alex Thomas	Yes
2024-05-31 00:00	Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode Content Blocks (Custom Post Widget) <= 3.3.0	`CVE-2024-3565`	6.4 Medium	Alex Thomas	Yes

Showing 1–10 of 76 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C