Benedictus Jovan (aillesiM)

Benedictus Jovan (aillesiM) is a security researcher credited with 54 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #122 of 3,899 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2024, with 43 findings.

Their research concentrates on Cross-Site Request Forgery (CSRF), which accounts for 23 of their findings (43%). Other recurring categories include Cross-Site Scripting, Missing Authorization. The average CVSS score across these disclosures is 4.6, peaking at 7.5. Severity breakdown: 0 critical and 1 high.

The most affected software includes WP To Do (5), Comparison Slider (3), SVS Pricing Tables (3), across 41 distinct plugins, themes and core versions in total.

33 of the 54 disclosed issues have a vendor fix, while 21 remain unpatched.

202420252026

Critical

High

Medium

Low

Global Rank

#122

of 3,899 researchers

Vulns

Critical0

High1

Medium53

Low0

Affected Assets

41plugins

Avg CVSS

4.6

Average score of vulnerabilities

Researcher Submissions

54 records


2026-09-18 19:57	Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action Empik for Woocommerce <= 1.5.1	`CVE-2026-9766`	4.3 Medium	Benedictus Jovan (aillesiM)	Yes
2026-09-18 19:56	WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints WordLift <= 3.54.10	`CVE-2026-9289`	5.3 Medium	Benedictus Jovan (aillesiM)	Yes
2026-09-18 19:54	Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping) Datalogics Ecommerce Delivery <= 2.6.65	`CVE-2026-9613`	4.3 Medium	Benedictus Jovan (aillesiM)	Yes
2026-09-18 18:57	Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions Flex Import <= 3.0	`CVE-2026-9615`	4.3 Medium	Benedictus Jovan (aillesiM)	Yes
2026-07-09 20:50	Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions Invoice123 <= 1.7.0	`CVE-2026-9857`	4.3 Medium	Benedictus Jovan (aillesiM)	Yes
2026-06-23 16:40	Generate Security.txt <= 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action Generate Security.txt <= 1.0.13	`CVE-2026-9616`	4.3 Medium	Benedictus Jovan (aillesiM)	Yes
2026-06-23 16:40	Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action Reviews and Rating <= 1.1.4	`CVE-2026-9619`	4.3 Medium	Benedictus Jovan (aillesiM)	No
2026-06-23 16:40	WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs WhatsOrder <= 1.0.1	`CVE-2026-9612`	5.3 Medium	Benedictus Jovan (aillesiM)	No
2026-06-17 00:00	Cargo Shipping Location for WooCommerce <= 5.6 - Unauthenticated SQL Injection Cargo Shipping Location for WooCommerce <= 5.6	`CVE-2026-54815`	7.5 High	Benedictus Jovan (aillesiM)	Yes
2026-05-27 18:40	PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink PeachPay <= 1.120.46	`CVE-2026-9618`	4.3 Medium	Benedictus Jovan (aillesiM)	Yes

Showing 1–10 of 54 reports