Dthangws

Dthangws is a security researcher credited with 15 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #359 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 7 of their findings (47%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.6, peaking at 9.8. Severity breakdown: 2 critical and 4 high.

The most affected software includes GiveWP (3), Element Pack Addons for Elementor (1), EmbedPress (1), across 13 distinct plugins, themes and core versions in total.

All 15 disclosed issues have since received a vendor fix. The most severe finding, "Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#359

of 3,823 researchers

Vulns

Critical2

High4

Medium9

Low0

Affected Assets

13plugins

Avg CVSS

6.6

Average score of vulnerabilities

Researcher Submissions

15 records


2026-10-08 00:00	rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Unauthenticated Arbitrary File Deletion rtMedia for WordPress <= 4.7.13	`CVE-2026-105892`	9.1 Critical	Dthangws	Yes
2026-10-02 13:57	Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment Jeg Kit for Elementor <= 3.2.19	`CVE-2026-100180`	5.4 Medium	Dthangws	Yes
2026-10-02 08:09	HUSKY – Products Filter for WooCommerce Professional <= 1.4.3.2 - Reflected Cross-Site Scripting HUSKY <= 1.4.3.2	`CVE-2026-95608`	6.1 Medium	Dthangws	Yes
2026-10-01 13:48	Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution Kirki <= 6.3.1	`CVE-2026-103065`	9.8 Critical	Dthangws	Yes
2026-09-30 12:47	Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization <= 4.2.14 - Missing Authorization Optimole <= 4.2.14	`CVE-2026-102375`	4.3 Medium	Dthangws	Yes
2026-09-25 00:00	EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting EmbedPress <= 4.6.6	`CVE-2026-85002`	6.4 Medium	Dthangws	Yes
2026-09-24 00:00	Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.15 - Unauthenticated Stored Cross-Site Scripting Happyforms <= 1.26.15	`CVE-2026-97065`	7.2 High	Dthangws	Yes
2026-09-24 00:00	YITH WooCommerce Ajax Search <= 2.28.0 - Unauthenticated Stored Cross-Site Scripting YITH WooCommerce Ajax Search <= 2.28.0	`CVE-2026-96352`	7.2 High	Dthangws	Yes
2026-09-23 10:48	Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting Ninja Forms <= 3.15.3	`CVE-2026-95515`	7.2 High	Dthangws	Yes
2026-09-18 14:02	Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter Tutor LMS <= 4.0.8	`CVE-2026-89333`	6.5 Medium	Dthangws	Yes

Showing 1–10 of 15 reports