ChamlaVic

ChamlaVic is a security researcher credited with 15 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #335 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 10 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 7 of their findings (47%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.0, peaking at 6.4.

The most affected software includes Alchemist Ajax Upload (1), Animated Pixel Marquee Creator (1), Crush.pics Image Optimizer (1), across 15 distinct plugins, themes and core versions in total.

4 of the 15 disclosed issues have a vendor fix, while 11 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#335

of 3,515 researchers

Vulns

Critical0

High0

Medium15

Low0

Affected Assets

15plugins

Avg CVSS

5.0

Average score of vulnerabilities

Researcher Submissions

15 records


2026-01-23 19:18	Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion Alchemist Ajax Upload <= 1.1	`CVE-2025-14629`	5.3 Medium	ChamlaVic	No
2026-01-13 16:49	Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update Crush.pics Image Optimizer <= 1.8.7	`CVE-2025-14482`	4.3 Medium	ChamlaVic	No
2026-01-13 16:47	Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting Makesweat <= 0.1	`CVE-2025-13627`	4.4 Medium	ChamlaVic	No
2026-01-06 20:47	Travel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Travel Bucket List <= 0.5.2	`CVE-2025-14053`	6.4 Medium	ChamlaVic	No
2026-01-06 20:28	WP Recipe Manager <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field WP Recipe Manager <= 1.0.0	`CVE-2025-13667`	6.4 Medium	ChamlaVic	No
2025-12-19 15:02	F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download F70 Lead Document Download <= 1.4.4	`CVE-2025-14633`	5.3 Medium	ChamlaVic	No
2025-12-12 14:51	Design Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Import Design Import/Export <= 2.2	`CVE-2025-14050`	4.9 Medium	ChamlaVic	Yes
2025-12-12 14:34	Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion Image Slider by Ays- Responsive Slider… <= 2.7.0	`CVE-2025-14454`	4.3 Medium	ChamlaVic	Yes
2025-12-11 14:33	TWW Protein Calculator <= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' Setting TWW Protein Calculator <= 1.0.24	`CVE-2025-13971`	4.4 Medium	ChamlaVic	No
2025-12-11 14:29	DebateMaster <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcode DebateMaster <= 1.0.0	`CVE-2025-14035`	4.4 Medium	ChamlaVic	No

Showing 1–10 of 15 reports