Eunho Kim

Eunho Kim is a security researcher credited with 9 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #546 of 3,878 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2026, with 6 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 3 of their findings (33%). Other recurring categories include Missing Authorization, Path Traversal. The average CVSS score across these disclosures is 5.9, peaking at 7.5. Severity breakdown: 0 critical and 2 high.

The most affected software includes CM Pop-Up (1), Easy Notify Lite (1), Generate PDF using Contact Form 7 (1), across 9 distinct plugins, themes and core versions in total.

All 9 disclosed issues have since received a vendor fix.

202420252026

Critical

High

Medium

Low

Global Rank

#546

of 3,878 researchers

Vulns

Critical0

High2

Medium7

Low0

Affected Assets

9plugins

Avg CVSS

5.9

Average score of vulnerabilities

Researcher Submissions

9 records


2026-10-15 16:22	NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route NotificationX <= 3.3.3	`CVE-2026-110721`	5.3 Medium	Eunho Kim	Yes
2026-10-04 00:00	Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Arbitrary File Read Generate PDF using Contact Form 7 <= 4.2.1	`CVE-2026-94666`	7.5 High	Eunho Kim	Yes
2026-10-04 00:00	PDF for Contact Form 7 + Drag and Drop Template Builder <= 7.1.0 - Unauthenticated Arbitrary File Read PDF for Contact Form 7 + Drag and Drop… <= 7.1.0	`CVE-2026-94664`	7.5 High	Eunho Kim	Yes
2026-10-02 17:41	WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter WP Ultimate Review <= 2.4.3	`CVE-2026-103519`	5.4 Medium	Eunho Kim	Yes
2026-09-30 16:41	Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter Redux Framework <= 4.5.14	`CVE-2026-88999`	4.3 Medium	Eunho Kim	Yes
2026-09-18 14:03	Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter Tutor LMS <= 4.0.8	`CVE-2026-88944`	4.3 Medium	Eunho Kim	Yes
2024-08-22 00:00	CM Pop-Up Banners <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CM Pop-Up <= 1.7.2	`CVE-2024-5799`	6.4 Medium	Eunho Kim	Yes
2024-06-21 00:00	Watu Quiz <= 3.4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting Watu Quiz <= 3.4.1.1	`CVE-2024-2640`	6.4 Medium	Eunho Kim	Yes
2024-05-27 00:00	Popup Builder <= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting Easy Notify Lite <= 1.1.32	`CVE-2024-3236`	6.4 Medium	Eunho Kim	Yes

Showing 1–9 of 9 reports