Erwan LR

Erwan LR is a security researcher credited with 163 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #47 of 3,515 contributors. Their disclosures were published between 2020 and 2026. The most productive year was 2023, with 93 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 75 of their findings (46%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization. The average CVSS score across these disclosures is 5.9, peaking at 9.8. Severity breakdown: 8 critical and 12 high.

The most affected software includes KiviCare (5), WPBot (5), EventON (4), across 121 distinct plugins, themes and core versions in total.

149 of the 163 disclosed issues have a vendor fix, while 14 remain unpatched. The most severe finding, "Streamit <= 4.5.0 - Unauthenticated Remote Code Execution", scores 9.8 out of 10.

2020202120222023202420252026

Critical

High

Medium

Low

Global Rank

#47

of 3,515 researchers

Vulns

166

Critical8

High13

Medium145

Low0

Affected Assets

141

138plugins2themes1core version

Avg CVSS

5.9

Average score of vulnerabilities

Researcher Submissions

163 records


2026-09-04 00:00	Pods – Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read Pods 3.3 – 3.3.9.1	`CVE-2026-74853`	6.5 Medium	Erwan LR	Yes
2026-09-03 00:00	Simple Ajax Chat – Add a Fast, Secure Chat Box < 20260827 - Unauthenticated Stored Cross-Site Scripting Simple Ajax Chat < 20260827	`CVE-2026-81807`	7.2 High	Erwan LR	Yes
2026-09-03 00:00	Shared Files Pro < 1.7.70 - Unauthenticated Arbitrary File Read Shared Files Pro < 1.7.70	`CVE-2026-19084`	7.5 High	Erwan LR	Yes
2026-08-31 00:00	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Missing Authorization User Profile Builder < 4.0.1	`CVE-2026-76548`	5.3 Medium	Erwan LR	Yes
2026-08-29 00:00	Newsletters < 4.17 - Cross-Site Request Forgery Newsletters < 4.17	`CVE-2026-17522`	4.3 Medium	Erwan LR	Yes
2026-08-27 00:00	MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion MStore API < 4.21.1	`CVE-2026-18233`	4.3 Medium	Erwan LR	Yes
2026-08-27 00:00	Newsletters < 4.17 - Insufficient Authorization Newsletters < 4.17	`CVE-2026-17520`	5.3 Medium	Erwan LR	Yes
2026-08-27 00:00	Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Upload Workeera < 1.0.6	`CVE-2026-77018`	8.8 High	Erwan LR	Yes
2026-08-27 00:00	MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization MStore API < 4.21.1	`CVE-2026-18234`	6.3 Medium	Erwan LR	Yes
2026-08-26 00:00	Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Contributor+) Stored Cross-Site Scripting Royal Addons for Elementor < 1.7.1066	`CVE-2026-19226`	6.4 Medium	Erwan LR	Yes

Showing 1–10 of 163 reports