apple502j

apple502j is a security researcher credited with 127 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #60 of 3,515 contributors. Their disclosures were published between 2021 and 2024. The most productive year was 2021, with 107 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 61 of their findings (48%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization. The average CVSS score across these disclosures is 6.0, peaking at 9.9. Severity breakdown: 5 critical and 16 high.

The most affected software includes Simple Download Monitor (7), Perfect Survey (4), Post Grid Gutenberg Blocks (4), across 89 distinct plugins, themes and core versions in total.

120 of the 127 disclosed issues have a vendor fix, while 7 remain unpatched. The most severe finding, "PDF Light Viewer <= 1.4.11 - Authenticated Command Injection", scores 9.9 out of 10.

2021202220232024

Critical

High

Medium

Low

Global Rank

#60

of 3,515 researchers

Vulns

127

Critical5

High16

Medium106

Low0

Affected Assets

107

106plugins1core version

Avg CVSS

6.0

Average score of vulnerabilities

Researcher Submissions

127 records


2024-06-24 00:00	WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal WordPress 6.5 4.1 – 6.5.4 · 26 branches	`CVE-2024-32111`	4.3 Medium	apple502j	Yes
2023-05-09 00:00	VK Blocks <= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Post VK Blocks Pro <= 1.53.0.1	`CVE-2023-27925`	6.4 Medium	apple502j	Yes
2023-05-09 00:00	VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting VK All in One Expansion Unit <= 9.88.1.0	`CVE-2023-27926`	6.4 Medium	apple502j	Yes
2023-05-09 00:00	VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post VK All in One Expansion Unit <= 9.88.1.0	`CVE-2023-28367`	6.4 Medium	apple502j	Yes
2023-05-09 00:00	VK Blocks <= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Tag Edit VK Blocks Pro <= 1.53.0.1	`CVE-2023-27923`	6.4 Medium	apple502j	Yes
2022-12-29 00:00	Passster – Password Protection <= 3.5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Passster <= 3.5.5.7	`CVE-2021-24837`	6.4 Medium	apple502j	Yes
2022-11-02 00:00	Download Plugin <= 1.6.2 - Missing Authorization and Sensitive Information Exposure Download Plugin <= 1.6.2	`CVE-2021-25059`	6.5 Medium	apple502j	Yes
2022-03-01 00:00	WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal Iptanus File Upload <= 4.16.2	`CVE-2021-24962`	6.5 Medium	apple502j	Yes
2022-02-14 00:00	WordPress File Upload <= 4.16.2 - Authenticated Stored Cross-Site Scripting via Shortcode Iptanus File Upload < 4.16.3	`CVE-2021-24961`	5.4 Medium	apple502j	Yes
2022-02-14 00:00	WordPress File Upload <= 4.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG Iptanus File Upload < 4.16.3	`CVE-2021-24960`	5.4 Medium	apple502j	Yes

Showing 1–10 of 127 reports