Civitasmass

Civitasmass is a security researcher credited with 6 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #700 of 3,866 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 2 of their findings (33%). Other recurring categories include Authentication Bypass Using An Alternate Path Or Channel, Deserialization Of Untrusted Data. The average CVSS score across these disclosures is 8.0, peaking at 9.8. Severity breakdown: 2 critical and 2 high.

The most affected software includes Easy Form Builder by WhiteStudio (1), pCloud WP Backup (1), Prime Mover (1), across 6 distinct plugins, themes and core versions in total.

5 of the 6 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#700

of 3,866 researchers

Vulns

Critical2

High2

Medium2

Low0

Affected Assets

6plugins

Avg CVSS

8.0

Average score of vulnerabilities

Researcher Submissions

6 records


2026-10-22 20:18	Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace Prime Mover <= 2.2.1	`CVE-2026-115806`	9.8 Critical	Civitasmass	No
2026-10-14 00:00	Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories 4.10.1 - 4.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Schedule Post Changes… 4.10.1 – 4.10.5	`CVE-2026-105261`	6.4 Medium	Civitasmass	Yes
2026-09-16 00:00	Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored Cross-Site Scripting Easy Form Builder by WhiteStudio 4.0.0 – 4.1.3	`CVE-2026-85122`	7.2 High	Civitasmass	Yes
2026-08-11 13:46	Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback Social Login <= 1.4.3	`CVE-2026-18961`	8.1 High	Civitasmass	Yes
2026-07-27 18:22	SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter SMS Alert <= 3.9.7	`CVE-2026-15014`	9.8 Critical	Civitasmass	Yes
2026-07-16 15:14	pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read pCloud WP Backup <= 2.0.3	`CVE-2026-14503`	6.5 Medium	Civitasmass	Yes

Showing 1–6 of 6 reports