Athiwat Tiprasaharn (Jitlada)

Athiwat Tiprasaharn (Jitlada) is a security researcher credited with 236 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #39 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 150 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 105 of their findings (44%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.1, peaking at 9.8. Severity breakdown: 8 critical and 39 high.

The most affected software includes Beaver Builder Page Builder (6), ELEX WordPress HelpDesk & Customer… (6), Image Photo Gallery Final Tiles Grid (3), across 198 distinct plugins, themes and core versions in total.

210 of the 236 disclosed issues have a vendor fix, while 26 remain unpatched. The most severe finding, "WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#39

of 3,515 researchers

Vulns

236

Critical8

High39

Medium189

Low0

Affected Assets

198

198plugins

Avg CVSS

6.1

Average score of vulnerabilities

Researcher Submissions

236 records


2026-09-14 12:04	Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter Co-Authors <= 4.15.0	`CVE-2026-85657`	5.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-09-08 00:00	Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting Graphina <= 3.1.11	`CVE-2026-13709`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-09-02 16:05	GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss' GutenKit <= 2.4.4	`CVE-2026-2573`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-08-25 00:00	Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI Greenshift <= 12.8.9	`CVE-2026-5092`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-08-22 00:37	Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute Image Photo Gallery Final Tiles Grid <= 3.6.12	`CVE-2026-4559`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-08-21 00:00	WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission WS Form LITE <= 1.10.80	`CVE-2026-4703`	9.8 Critical	Athiwat Tiprasaharn (Jitlada)	Yes
2026-08-18 11:03	PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure PPWP <= 1.9.15	`CVE-2025-11729`	4.3 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-08-04 18:28	TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter TableOn <= 1.0.5.1	`CVE-2026-18881`	7.5 High	Athiwat Tiprasaharn (Jitlada)	Yes
2026-08-04 18:22	LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload LightSync Pro <= 2.1.6	`CVE-2026-6147`	8.8 High	Athiwat Tiprasaharn (Jitlada)	Yes
2026-08-04 16:45	Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion Content Egg <= 11.3.0	`CVE-2026-15979`	8.1 High	Athiwat Tiprasaharn (Jitlada)	Yes

Showing 1–10 of 236 reports