dc11

dc11 is a security researcher credited with 49 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #121 of 3,515 contributors. Their disclosures were published between 2021 and 2026. The most productive year was 2023, with 24 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 16 of their findings (33%). Other recurring categories include SQL Injection, Missing Authorization. The average CVSS score across these disclosures is 7.1, peaking at 9.8. Severity breakdown: 4 critical and 19 high.

The most affected software includes WP Mail Log (4), Accept Donations with PayPal & Stripe (3), SupportCandy (3), across 36 distinct plugins, themes and core versions in total.

47 of the 49 disclosed issues have a vendor fix, while 2 remain unpatched. The most severe finding, "Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

202120222023202420252026

Critical

High

Medium

Low

Global Rank

#121

of 3,515 researchers

Vulns

Critical4

High19

Medium26

Low0

Affected Assets

36plugins

Avg CVSS

7.1

Average score of vulnerabilities

Researcher Submissions

49 records


2026-07-08 00:00	UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass UsersWP < 1.2.67	`CVE-2026-13690`	5.3 Medium	dc11	Yes
2023-11-28 00:00	WP Mail Log <= 1.1.2 - Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion WP Mail Log <= 1.1.2	`CVE-2023-5644`	6.4 Medium	dc11	Yes
2023-11-28 00:00	WP Mail Log <= 1.1.2 - Authenticated (Contributor+) Arbitrary File Read WP Mail Log <= 1.1.2	`CVE-2023-5672`	6.5 Medium	dc11	Yes
2023-11-28 00:00	WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL injection via key WP Mail Log <= 1.1.2	`CVE-2023-5645`	8.8 High	dc11	Yes
2023-11-20 00:00	WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL Injection via id WP Mail Log <= 1.1.2	`CVE-2023-5674`	7.2 High	dc11	Yes
2023-11-06 00:00	Woocommerce Vietnam Checkout <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting Vietnam Checkout for WooCommerce <= 2.0.5	`CVE-2023-5325`	7.2 High	dc11	Yes
2023-10-31 00:00	WP Meta and Date Remover < 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via settings WP Meta and Date Remover < 2.2.0	`CVE-2023-4823`	6.4 Medium	dc11	Yes
2023-09-07 00:00	Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload Form Maker by 10Web < 1.15.20	`CVE-2023-4666`	9.8 Critical	dc11	Yes
2023-05-22 00:00	SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection SupportCandy <= 3.1.6	`CVE-2023-2719`	8.8 High	dc11	Yes
2023-05-22 00:00	SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection SupportCandy <= 3.1.6	`CVE-2023-2805`	7.2 High	dc11	Yes

Showing 1–10 of 49 reports