Bob Matyas

Bob Matyas is a security researcher credited with 348 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #21 of 3,515 contributors. Their disclosures were published between 2023 and 2026. The most productive year was 2024, with 254 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 226 of their findings (65%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection. The average CVSS score across these disclosures is 5.2, peaking at 9.8. Severity breakdown: 4 critical and 14 high.

The most affected software includes Wp EMember (8), WP eStore (8), WP Affiliate Platform (7), across 255 distinct plugins, themes and core versions in total.

166 of the 348 disclosed issues have a vendor fix, while 182 remain unpatched. The most severe finding, "Bug Library <= 2.1 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

2023202420252026

Critical

High

Medium

Low

Global Rank

#21

of 3,515 researchers

Vulns

348

Critical4

High14

Medium330

Low0

Affected Assets

255

253plugins2themes

Avg CVSS

5.2

Average score of vulnerabilities

Researcher Submissions

348 records


2026-08-03 00:00	Nexter Blocks <= 5.0.1 - Authenticated (Author+) Stored Cross-Site Scripting Nexter Blocks <= 5.0.1	`CVE-2025-15678`	6.4 Medium	Bob Matyas	Yes
2026-02-17 00:00	Court Reservation – Manage Your Court Bookings Online < 1.10.9 - Cross-Site Request Forgery Court Reservation < 1.10.9	`CVE-2026-1508`	4.3 Medium	Bob Matyas	Yes
2026-02-13 00:00	eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion WP eCommerce <= 3.15.1	`CVE-2026-1128`	4.3 Medium	Bob Matyas	No
2026-01-31 00:00	Conditional CAPTCHA <= 4.0.0 - Unauthenticated Open Redirect Conditional CAPTCHA <= 4.0.0	`CVE-2026-1369`	5.3 Medium	Bob Matyas	No
2025-11-21 00:00	WPS Visitor Counter <= 1.4.8 - Reflected Cross-Site Scripting WPS Visitor Counter <= 1.4.8	`CVE-2025-9116`	6.1 Medium	Bob Matyas	No
2025-11-03 00:00	Front User Submit <= 4.9.5 - Open Redirect Guest posting / Frontend Posting /… <= 4.9.5	`CVE-2025-12569`	4.7 Medium	Bob Matyas	Yes
2025-10-30 00:00	NS Maintenance Mode for WP <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting NS Maintenance Mode for WP <= 1.3.1	`CVE-2025-10636`	4.4 Medium	Bob Matyas	No
2025-09-01 00:00	Markup Markdown <= 3.20.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Markup Markdown <= 3.20.9	`CVE-2025-9541`	6.4 Medium	Bob Matyas	Yes
2025-09-01 00:00	Etsy Shop <= 3.0.6 - Reflected Cross-Site Scripting Etsy Shop <= 3.0.6	`CVE-2025-9115`	6.1 Medium	Bob Matyas	Yes
2025-08-22 00:00	Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] Contact Form 7 reCAPTCHA <= 1.2.0	`CVE-2025-8280`	6.1 Medium	Bob Matyas	No

Showing 1–10 of 250 reports

Showing the 250 most recent of 348 records. Every record has its own page and is listed in the sitemap.