Dao Xuan Hieu

Dao Xuan Hieu is a security researcher credited with 7 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #585 of 3,515 contributors. Their disclosures were published between 2023 and 2025. The most productive year was 2023, with 6 findings.

Their research concentrates on SQL Injection, which accounts for 4 of their findings (57%). Other recurring categories include Cross-Site Scripting, Missing Authorization. The average CVSS score across these disclosures is 6.5, peaking at 8.8. Severity breakdown: 0 critical and 3 high.

The most affected software includes EazyDocs (2), Locatoraid Store Locator (1), MultiParcels Shipping For WooCommerce (1), across 6 distinct plugins, themes and core versions in total.

6 of the 7 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "EazyDocs <= 2.3.3 - Authenticated (Subscriber+) SQL Injection", scores 8.8 out of 10.

202320242025

Critical

High

Medium

Low

Global Rank

#585

of 3,515 researchers

Vulns

Critical0

High3

Medium3

Low1

Affected Assets

6plugins

Avg CVSS

6.5

Average score of vulnerabilities

Researcher Submissions

7 records


2025-05-16 00:00	Short URL <= 1.6.8 - Authenticated (Subscriber+) SQL Injection Short URL <= 1.6.8	`CVE-2023-2921`	6.5 Medium	Dao Xuan Hieu	No
2023-12-21 00:00	EazyDocs 2.3.8 - 2.3.9 - Missing Authorization EazyDocs 2.3.8 – 2.3.9	`CVE-2024-0248`	4.3 Medium	Dao Xuan Hieu	Yes
2023-11-20 00:00	EazyDocs <= 2.3.3 - Authenticated (Subscriber+) SQL Injection EazyDocs < 2.3.4	`CVE-2023-6035`	8.8 High	Dao Xuan Hieu	Yes
2023-09-26 00:00	Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Authenticated (Admin+) Arbitrary File Upload Ni Purchase Order(PO) For WooCommerce <= 1.2.1	`CVE-2023-5957`	3.8 Low	Dao Xuan Hieu	Yes
2023-09-25 00:00	WPSchoolPress <= 2.2.4 - Authenticated(Teacher+) SQL Injection via ClassID School Management System <= 2.2.4	`CVE-2023-4776`	7.2 High	Dao Xuan Hieu	Yes
2023-08-28 00:00	Locatoraid Store Locator <= 3.9.23 - Reflected Cross-Site Scripting Locatoraid Store Locator <= 3.9.23	`CVE-2023-4476`	6.1 Medium	Dao Xuan Hieu	Yes
2023-07-17 00:00	MultiParcels Shipping For WooCommerce <= 1.14.12 - Authenticated(Subscriber+) SQL Injection via id MultiParcels Shipping For WooCommerce <= 1.14.12	`CVE-2023-2843`	8.8 High	Dao Xuan Hieu	Yes

Showing 1–7 of 7 reports