ardias

ardias is a security researcher credited with 49 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #125 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2024, with 36 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 21 of their findings (43%). Other recurring categories include Cross-Site Request Forgery (CSRF), Open Redirect. The average CVSS score across these disclosures is 6.4, peaking at 9.8. Severity breakdown: 1 critical and 7 high.

The most affected software includes ACF City Selector (1), addWeather (1), Background Control (1), across 49 distinct plugins, themes and core versions in total.

23 of the 49 disclosed issues have a vendor fix, while 26 remain unpatched. The most severe finding, "JobBoard Job listing <= 1.2.6 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

20242025

Critical

High

Medium

Low

Global Rank

#125

of 3,515 researchers

Vulns

Critical1

High7

Medium41

Low0

Affected Assets

49plugins

Avg CVSS

6.4

Average score of vulnerabilities

Researcher Submissions

49 records


2025-02-03 00:00	Child Themes Helper <= 2.2.7 - Cross-Site Request Forgery to Arbitrary File Deletion Child Themes Helper <= 2.2.7	`CVE-2025-25093`	8.1 High	ardias	No
2025-01-24 00:00	KB Support <= 1.6.7 - Unauthenticated Open Redirect KB Support <= 1.6.7	`CVE-2025-24741`	6.1 Medium	ardias	Yes
2025-01-24 00:00	LearnPress <= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect LearnPress <= 4.2.7.1	`CVE-2025-24740`	5.4 Medium	ardias	Yes
2025-01-16 00:00	Book a Place <= 0.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting Book a Place <= 0.7.1	`CVE-2025-23690`	6.1 Medium	ardias	No
2025-01-16 00:00	Shipdeo <= 1.2.8 - Reflected Cross-Site Scripting Shipdeo <= 1.2.8	`CVE-2025-23457`	6.1 Medium	ardias	No
2025-01-16 00:00	Event Countdown Timer Plugin by TechMix <= 1.4 - Reflected Cross-Site Scripting Event Countdown Timer Plugin by TechMix <= 1.4	`CVE-2025-23699`	6.1 Medium	ardias	No
2025-01-16 00:00	Blogger Image Import 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting Blogger Image Import 2.1	`CVE-2025-23689`	6.1 Medium	ardias	No
2025-01-16 00:00	Stars SMTP Mailer <= 1.7 - Reflected Cross-Site Scripting Stars SMTP Mailer <= 1.7	`CVE-2025-23453`	6.1 Medium	ardias	Yes
2025-01-14 00:00	User Management <= 1.1 - Authenticated (Subscriber+) Privilege Escalation User Management <= 1.1	`CVE-2025-22736`	8.8 High	ardias	Yes
2025-01-13 00:00	Background Control <= 1.0.5 - Cross-Site Request Forgery to Arbitrary File Deletion Background Control <= 1.0.5	`CVE-2025-22784`	8.1 High	ardias	No

Showing 1–10 of 49 reports