Deadbee

Deadbee is a security researcher credited with 16 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #318 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 9 findings.

Their research concentrates on Cross-Site Request Forgery (CSRF), which accounts for 4 of their findings (25%). Other recurring categories include Cross-Site Scripting, Missing Authorization. The average CVSS score across these disclosures is 5.4, peaking at 7.3. Severity breakdown: 0 critical and 2 high.

The most affected software includes Secure Copy Content Protection… (3), Tainacan (3), Chatbot for WordPress by Collect.chat ⚡️ (1), across 12 distinct plugins, themes and core versions in total.

15 of the 16 disclosed issues have a vendor fix, while 1 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#318

of 3,515 researchers

Vulns

Critical0

High2

Medium14

Low0

Affected Assets

12plugins

Avg CVSS

5.4

Average score of vulnerabilities

Researcher Submissions

16 records


2026-07-28 21:20	FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle FuseWP <= 1.1.24.2	`CVE-2026-5582`	4.3 Medium	Deadbee	Yes
2026-02-13 18:32	Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.8	`CVE-2026-0736`	6.4 Medium	Deadbee	Yes
2026-02-12 01:05	Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header Secure Copy Content Protection… <= 4.9.8	`CVE-2026-1320`	7.2 High	Deadbee	Yes
2026-01-30 12:12	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure NEX-Forms <= 9.1.8	`CVE-2025-15510`	5.3 Medium	Deadbee	Yes
2026-01-27 17:49	New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure New User Approve <= 3.2.2	`CVE-2026-0832`	7.3 High	Deadbee	Yes
2026-01-15 19:09	RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className WP RSS Aggregator <= 5.0.10	`CVE-2025-14375`	6.1 Medium	Deadbee	Yes
2026-01-12 00:00	EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API EventPrime <= 4.2.7.0	`CVE-2025-14507`	5.3 Medium	Deadbee	Yes
2025-12-20 14:07	Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation Tainacan <= 1.0.1	`CVE-2025-14043`	5.3 Medium	Deadbee	Yes
2025-12-17 23:36	Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery Prime Slider <= 4.0.9	`CVE-2025-14277`	4.3 Medium	Deadbee	Yes
2025-12-11 21:22	Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File Secure Copy Content Protection… <= 4.9.2	`CVE-2025-14442`	5.3 Medium	Deadbee	Yes

Showing 1–10 of 16 reports