d.v4n_s3c

d.v4n_s3c is a security researcher credited with 21 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #266 of 3,878 contributors. The disclosure was published in 2026.

Their research concentrates on Improper Privilege Management, which accounts for 9 of their findings (43%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, SQL Injection. The average CVSS score across these disclosures is 8.5, peaking at 9.8. Severity breakdown: 7 critical and 11 high.

The most affected software includes Super Forms (5), Appointment Booking Plugin (2), Abandoned Cart Pro for WooCommerce (1), across 16 distinct plugins, themes and core versions in total.

All 21 disclosed issues have since received a vendor fix. The most severe finding, "Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#266

of 3,878 researchers

Vulns

Critical7

High11

Medium3

Low0

Affected Assets

15plugins1theme

Avg CVSS

8.5

Average score of vulnerabilities

Researcher Submissions

21 records


2026-10-07 16:28	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute Super Forms <= 6.3.316	`CVE-2026-17196`	8.8 High	d.v4n_s3c	Yes
2026-10-07 16:28	Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter Super Forms <= 6.3.316	`CVE-2026-17609`	9.1 Critical	d.v4n_s3c	Yes
2026-10-07 00:00	Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter Bricksforge <= 3.1.8.9	`CVE-2026-85097`	9.8 Critical	d.v4n_s3c	Yes
2026-10-05 17:59	ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template ACPT (Premium) <= 2.0.66	`CVE-2026-105701`	8.8 High	d.v4n_s3c	Yes
2026-10-01 16:34	Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login Super Forms <= 6.3.316	`CVE-2026-15897`	8.8 High	d.v4n_s3c	Yes
2026-09-30 20:15	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter Super Forms <= 6.3.316	`CVE-2026-15983`	8.1 High	d.v4n_s3c	Yes
2026-09-30 19:23	Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter Super Forms <= 6.3.316	`CVE-2026-15989`	9.8 Critical	d.v4n_s3c	Yes
2026-09-04 00:00	Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation Abandoned Cart Pro for WooCommerce <= 10.7.1	`CVE-2026-81543`	8.8 High	d.v4n_s3c	Yes
2026-09-01 00:00	Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' Booking for Appointments and Events… 8.0 – 9.6.2	`CVE-2026-9055`	9.8 Critical	d.v4n_s3c	Yes
2026-08-31 21:31	Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter Nokri <= 1.6.6	`CVE-2026-18550`	9.8 Critical	d.v4n_s3c	Yes

Showing 1–10 of 21 reports