d.v4n_s3c

d.v4n_s3c is a security researcher credited with 15 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #324 of 3,515 contributors. The disclosure was published in 2026.

Their research concentrates on Improper Privilege Management, which accounts for 8 of their findings (53%). Other recurring categories include SQL Injection, Cross-Site Scripting. The average CVSS score across these disclosures is 8.4, peaking at 9.8. Severity breakdown: 5 critical and 7 high.

The most affected software includes Appointment Booking Plugin (2), Abandoned Cart Pro for WooCommerce (1), ACPT (Premium) (1), across 14 distinct plugins, themes and core versions in total.

All 15 disclosed issues have since received a vendor fix. The most severe finding, "ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#324

of 3,515 researchers

Vulns

Critical5

High7

Medium3

Low0

Affected Assets

13plugins1theme

Avg CVSS

8.4

Average score of vulnerabilities

Researcher Submissions

15 records


2026-09-04 00:00	Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation Abandoned Cart Pro for WooCommerce <= 10.7.1	`CVE-2026-81543`	8.8 High	d.v4n_s3c	Yes
2026-09-03 18:24	ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter ACPT (Premium) <= 2.0.66	`CVE-2026-15354`	9.8 Critical	d.v4n_s3c	Yes
2026-09-01 00:00	Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' Booking for Appointments and Events… 8.0 – 9.6.2	`CVE-2026-9055`	9.8 Critical	d.v4n_s3c	Yes
2026-08-31 21:31	Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter Nokri <= 1.6.6	`CVE-2026-18550`	9.8 Critical	d.v4n_s3c	Yes
2026-08-31 21:00	WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter WPBakery Page Builder <= 8.7.4	`CVE-2026-15101`	6.4 Medium	d.v4n_s3c	Yes
2026-08-28 00:00	Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field SigmaForms Pro <= 1.4.5	`CVE-2026-14494`	9.8 Critical	d.v4n_s3c	Yes
2026-08-11 06:12	AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update AcyMailing <= 10.11.1	`CVE-2026-15426`	8.8 High	d.v4n_s3c	Yes
2026-08-07 18:30	AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route AI Copilot <= 1.5.6	`CVE-2026-14526`	9.8 Critical	d.v4n_s3c	Yes
2026-06-30 21:30	LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter Appointment Booking Plugin <= 5.6.3	`CVE-2026-13228`	8.8 High	d.v4n_s3c	Yes
2026-06-30 15:24	Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter Taskbuilder <= 5.0.8	`CVE-2026-12110`	6.5 Medium	d.v4n_s3c	Yes

Showing 1–10 of 15 reports