alex_henry20

alex_henry20 is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #551 of 3,513 contributors. The disclosure was published in 2026.

Their research concentrates on Authorization Bypass Through User-Controlled Key, which accounts for 2 of their findings (25%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting. The average CVSS score across these disclosures is 5.4, peaking at 6.5.

The most affected software includes Appointment Booking Plugin (2), Dokan: AI Powered WooCommerce… (1), Download Monitor (1), across 7 distinct plugins, themes and core versions in total.

All 8 disclosed issues have since received a vendor fix.

2026

Critical

High

Medium

Low

Global Rank

#551

of 3,513 researchers

Vulns

Critical0

High0

Medium8

Low0

Affected Assets

7plugins

Avg CVSS

5.4

Average score of vulnerabilities

Researcher Submissions

8 records


2026-08-05 22:11	LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Appointment Booking Plugin <= 5.3.2	`CVE-2026-5391`	6.4 Medium	alex_henry20	Yes
2026-07-02 18:30	Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure Quiz and Survey Master (QSM) <= 11.1.4	`CVE-2026-9230`	4.3 Medium	alex_henry20	Yes
2026-07-02 00:00	GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute GenerateBlocks <= 2.2.1	`CVE-2026-9756`	6.4 Medium	alex_henry20	Yes
2026-06-17 14:54	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers Dokan: AI Powered WooCommerce… <= 5.0.3	`CVE-2026-10023`	4.3 Medium	alex_henry20	Yes
2026-06-05 11:05	LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action Appointment Booking Plugin <= 5.6.0	`CVE-2026-9719`	4.3 Medium	alex_henry20	Yes
2026-05-27 14:52	Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route Independent Analytics <= 2.14.9	`CVE-2026-5737`	6.5 Medium	alex_henry20	Yes
2026-05-13 19:51	MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter MW WP Form <= 5.1.2	`CVE-2026-6206`	5.3 Medium	alex_henry20	Yes
2026-04-07 11:17	Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling Download Monitor <= 5.1.10	`CVE-2026-4401`	5.4 Medium	alex_henry20	Yes

Showing 1–8 of 8 reports