endy

endy is a security researcher credited with 15 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #310 of 3,333 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 4 of their findings (27%). Other recurring categories include SQL Injection, Missing Authorization. The average CVSS score across these disclosures is 7.1, peaking at 8.8. Severity breakdown: 0 critical and 9 high.

The most affected software includes Contest Gallery (2), Motors (2), Active Woot Products Tables… (1), across 13 distinct plugins, themes and core versions in total.

All 15 disclosed issues have since received a vendor fix. The most severe finding, "E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter", scores 8.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#310

of 3,333 researchers

Vulns

Critical0

High9

Medium6

Low0

Affected Assets

13plugins

Avg CVSS

7.1

Average score of vulnerabilities

Researcher Submissions

15 records


2026-07-07 00:00	Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 - Authenticated (Cashier+) SQL Injection Vitepos <= 3.4.2	`CVE-2026-57385`	6.5 Medium	endy	Yes
2026-06-29 00:00	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting MasterStudy LMS WordPress Plugin <= 3.7.27	`CVE-2026-57330`	6.4 Medium	endy	Yes
2026-06-29 00:00	Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.4.8 - Authenticated (Performer+) Arbitrary File Deletion Paid Videochat Turnkey Site <= 7.4.8	`CVE-2026-57331`	8.1 High	endy	Yes
2026-06-26 00:00	Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion Panorama <= 1.6.1	`CVE-2026-57647`	7.5 High	endy	Yes
2026-06-17 14:55	E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter E2Pdf <= 1.32.26	`CVE-2026-12407`	8.8 High	endy	Yes
2026-06-17 00:00	Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion Motors <= 1.4.109	`CVE-2026-54814`	7.5 High	endy	Yes
2026-06-17 00:00	SALESmanago & Leadoo <= 3.11.2 - Authenticated (Subscriber+) SQL Injection Manago AI & Leadoo AI <= 3.11.2	`CVE-2026-54822`	6.5 Medium	endy	Yes
2026-06-17 00:00	Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection Motors <= 1.4.109	`CVE-2026-54812`	7.5 High	endy	Yes
2026-06-05 00:00	WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion WP User Manager <= 2.9.16	`CVE-2026-49766`	8.1 High	endy	Yes
2026-06-03 00:00	Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting Quiz and Survey Master (QSM) <= 11.1.2	`CVE-2026-48867`	7.2 High	endy	Yes

Showing 1–10 of 15 reports