Claudio Marchesini

Claudio Marchesini is a security researcher credited with 13 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #386 of 3,917 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 3 of their findings (23%). Other recurring categories include Improper Privilege Management, Missing Authorization. The average CVSS score across these disclosures is 6.9, peaking at 9.1. Severity breakdown: 1 critical and 6 high.

The most affected software includes HIPAA Forms (2), Accept PayPal Payments using Contact… (1), BackupSheep WordPress Backup Plugin (1), across 12 distinct plugins, themes and core versions in total.

8 of the 13 disclosed issues have a vendor fix, while 5 remain unpatched. The most severe finding, "BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion", scores 9.1 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#386

of 3,917 researchers

Vulns

Critical1

High6

Medium7

Low0

Affected Assets

14plugins

Avg CVSS

6.8

Average score of vulnerabilities

Researcher Submissions

13 records


2026-10-23 00:00	HIPAA Forms < 3.3.2 - Authenticated (Custom Role+) Privilege Escalation HIPAA Forms < 3.3.2	`CVE-2026-109927`	6.3 Medium	Enrico Marcolini	Yes
2026-10-20 00:00	Infility Global <= 2.16.24 - Missing Authorization Infility Global <= 2.16.24	`CVE-2026-109931`	5.3 Medium	Enrico Marcolini	Yes
2026-10-20 00:00	CM HIPAA Forms <= 3.3.1 - Authenticated (hipaa_forms+) Privilege Escalation HIPAA Forms <= 3.3.1	`CVE-2026-109927`	8.8 High	Enrico Marcolini	Yes
2026-10-14 00:00	Fast Courier – Shipping & Freight 5.0.0 - 5.2.3 - Unauthenticated SQL Injection Fast Courier 5.0.0 – 5.2.3	`CVE-2026-89288`	7.5 High	Enrico Marcolini	Yes
2026-10-13 00:00	eaSYNC <= 1.3.30 - Missing Authorization eaSYNC Booking <= 1.3.30	`CVE-2026-103304`	5.3 Medium	Enrico Marcolini	Yes
2026-10-13 00:00	User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation User Rights Access Manager <= 1.1.3	`CVE-2026-109145`	7.3 High	Enrico Marcolini	No
2026-10-09 00:00	Prenotazioni <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting Prenotazioni <= 1.7.5	`CVE-2026-103305`	7.2 High	Enrico Marcolini	No
2026-10-08 00:00	Accept PayPal Payments Using Contact Form 7 <= 4.0.6 - Unauthenticated Information Exposure Accept PayPal Payments using Contact… <= 4.0.6	`CVE-2026-105990`	5.3 Medium	Enrico Marcolini	Yes
2026-10-05 00:00	Magee Shortcodes <= 2.1.1 - Reflected Cross-Site Scripting Magee Shortcodes <= 2.1.1	`CVE-2026-105316`	6.1 Medium	Enrico Marcolini	No
2026-09-29 00:00	BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion BackupSheep WordPress Backup Plugin <= 1.8	`CVE-2026-101148`	9.1 Critical	Enrico Marcolini	No

Showing 1–10 of 13 reports