Elliot

Elliot is a security researcher credited with 29 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #192 of 3,515 contributors. Their disclosures were published between 2023 and 2024. The most productive year was 2023, with 25 findings.

Their research concentrates on Cross-Site Request Forgery (CSRF), which accounts for 16 of their findings (55%). Other recurring categories include Missing Authorization, Cross-Site Scripting. The average CVSS score across these disclosures is 5.0, peaking at 7.2. Severity breakdown: 0 critical and 1 high.

The most affected software includes Button Generator (2), Animator (1), BadgeOS (1), across 28 distinct plugins, themes and core versions in total.

21 of the 29 disclosed issues have a vendor fix, while 8 remain unpatched.

20232024

Critical

High

Medium

Low

Global Rank

#192

of 3,515 researchers

Vulns

Critical0

High1

Medium28

Low0

Affected Assets

28plugins

Avg CVSS

5.0

Average score of vulnerabilities

Researcher Submissions

29 records


2024-04-26 00:00	ClickCease Click Fraud Protection <= 3.2.7 - Cross-Site Request Forgery ClickCease Click Fraud Protection <= 3.2.7	`CVE-2024-33678`	4.3 Medium	Elliot	Yes
2024-03-26 00:00	Radio Player <= 2.0.73 - Missing Authorization via get_players Radio Player <= 2.0.73	`CVE-2024-2906`	5.3 Medium	Elliot	Yes
2024-01-31 00:00	Load More Anything <= 3.3.3 - Missing Authorization to Plugin Settings Modification Load More Anything <= 3.3.3	`CVE-2024-24704`	5.4 Medium	Elliot	Yes
2024-01-08 00:00	Droit Elementor Addons <= 3.1.5 - Cross-Site Request Forgery Droit Elementor Addons <= 3.1.5	`CVE-2024-22136`	4.3 Medium	Elliot	No
2023-12-27 00:00	Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery via apbct_settings__update_account_email Spam protection <= 6.20	`CVE-2023-51696`	4.3 Medium	Elliot	Yes
2023-11-28 00:00	Quantity Plus Minus Button for WooCommerce by CodeAstrology <= 1.1.9 - Cross-Site Request Forgery via wqpmb_form_submit Quantity Plus Minus Button… <= 1.1.9	`CVE-2023-48768`	6.5 Medium	Elliot	Yes
2023-11-28 00:00	Button Generator – easily Button Builder <= 2.3.8 - Missing Authorization Button Generator <= 2.3.8	`CVE-2023-49154`	5.3 Medium	Elliot	Yes
2023-11-28 00:00	Button Generator – easily Button Builder <= 2.3.8 - Cross-Site Request Forgery Button Generator <= 2.3.8	`CVE-2023-49155`	4.3 Medium	Elliot	Yes
2023-11-09 00:00	Animator <= 3.0.10 - Missing Authorization to Plugin Settings Update Animator <= 3.0.10	`CVE-2023-47689`	5.3 Medium	Elliot	Yes
2023-11-07 00:00	BadgeOS <= 3.7.1.6 - Missing Authorization BadgeOS <= 3.7.1.6	`CVE-2023-47647`	4.3 Medium	Elliot	No

Showing 1–10 of 29 reports