C_T_R_L

C_T_R_L is a security researcher credited with 7 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #570 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2024, with 6 findings.

Their research concentrates on Unrestricted Upload Of File With Dangerous Type, which accounts for 4 of their findings (57%). Other recurring categories include Cross-Site Scripting, Code Injection. The average CVSS score across these disclosures is 7.5, peaking at 9.8. Severity breakdown: 1 critical and 3 high.

The most affected software includes Ajar in5 Embed (1), Convert Docx2post (1), Gallerio (1), across 7 distinct plugins, themes and core versions in total.

2 of the 7 disclosed issues have a vendor fix, while 5 remain unpatched. The most severe finding, "Ajar in5 Embed <= 3.1.3 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

20242025

Critical

High

Medium

Low

Global Rank

#570

of 3,515 researchers

Vulns

Critical1

High3

Medium3

Low0

Affected Assets

7plugins

Avg CVSS

7.5

Average score of vulnerabilities

Researcher Submissions

7 records


2025-01-15 11:56	Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title Motors <= 1.4.43	`CVE-2024-10970`	5.4 Medium	ghsinfosec	Yes
2024-11-20 00:00	Tailored Tools <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Tailored Tools <= 1.8.4	`CVE-2024-52503`	6.4 Medium	C_T_R_L	No
2024-11-13 00:00	Convert Docx2post <= 1.4 - Authenticated (Author+) Arbitrary File Upload Convert Docx2post <= 1.4	`CVE-2024-52397`	8.8 High	C_T_R_L	No
2024-11-13 00:00	Gallerio <= 1.01 - Authenticated (Subscriber+) Arbitrary File Upload Gallerio <= 1.01	`CVE-2024-52400`	8.8 High	C_T_R_L	No
2024-10-31 00:00	Simple Business Manager <= 4.6.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Simple Business Manager <= 4.6.7.4	`CVE-2024-51599`	6.4 Medium	C_T_R_L	No
2024-10-25 00:00	Ajar in5 Embed <= 3.1.3 - Unauthenticated Arbitrary File Upload Ajar in5 Embed <= 3.1.3	`CVE-2024-50473`	9.8 Critical	C_T_R_L	Yes
2024-10-17 00:00	Property Lot Management System <= 1.0 - Authenticated (Salesman+) Arbitrary File Upload Property Lot Management System <= 1.0	`CVE-2024-49331`	7.2 High	C_T_R_L	No

Showing 1–7 of 7 reports