AlexHenry

AlexHenry is a security researcher credited with 20 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #285 of 3,878 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 15 findings.

Their research concentrates on Missing Authorization, which accounts for 6 of their findings (30%). Other recurring categories include Cross-Site Scripting, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.1, peaking at 8.8. Severity breakdown: 0 critical and 5 high.

The most affected software includes LearnPress (2), Ad Inserter (1), All-in-One WP Migration and Backup (1), across 19 distinct plugins, themes and core versions in total.

All 20 disclosed issues have since received a vendor fix. The most severe finding, "WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor", scores 8.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#285

of 3,878 researchers

Vulns

Critical0

High5

Medium15

Low0

Affected Assets

19plugins

Avg CVSS

6.1

Average score of vulnerabilities

Researcher Submissions

20 records


2026-09-15 15:12	Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' Getwid 2.1.3	`CVE-2026-5924`	6.4 Medium	AlexHenry	Yes
2026-08-05 22:18	Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax Ad Inserter <= 2.8.16	`CVE-2026-11983`	5.3 Medium	AlexHenry	Yes
2026-06-30 16:02	WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name WPForms <= 1.10.2	`CVE-2026-12127`	5.3 Medium	AlexHenry	Yes
2026-06-05 10:46	RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions RSS Aggregator by Feedzy <= 5.1.7	`CVE-2026-8976`	4.3 Medium	AlexHenry	Yes
2026-05-28 18:57	Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form Media Library Assistant <= 3.35	`CVE-2026-6075`	8.1 High	AlexHenry	Yes
2026-05-27 14:55	Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function Timetable and Event Schedule… <= 2.4.16	`CVE-2026-9228`	4.3 Medium	AlexHenry	Yes
2026-05-04 16:06	ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite ElementsKit Elementor Addons <= 3.8.2	`CVE-2026-4362`	6.5 Medium	AlexHenry	Yes
2026-05-01 16:12	Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes Gutenberg Essential Blocks <= 6.0.4	`CVE-2026-4658`	6.4 Medium	AlexHenry	Yes
2026-04-30 00:00	WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor WP Editor <= 1.2.9.2	`CVE-2026-3772`	8.8 High	AlexHenry	Yes
2026-04-16 13:23	WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation WP Statistics <= 14.16.4	`CVE-2026-3488`	6.5 Medium	AlexHenry	Yes

Showing 1–10 of 20 reports