Frank

Frank is a security researcher credited with 12 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #372 of 3,515 contributors. The disclosure was published in 2025.

Their research concentrates on SQL Injection, which accounts for 4 of their findings (33%). Other recurring categories include Deserialization Of Untrusted Data, Cross-Site Scripting. The average CVSS score across these disclosures is 7.1, peaking at 9.8. Severity breakdown: 1 critical and 6 high.

The most affected software includes LMS - Education WordPress Theme (2), Nuss - Hotel Booking WordPress (2), Sala - Startup & SaaS WordPress Theme (2), across 9 distinct plugins, themes and core versions in total.

4 of the 12 disclosed issues have a vendor fix, while 8 remain unpatched. The most severe finding, "LogisticsHub <= 1.1.6 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

2025

Critical

High

Medium

Low

Global Rank

#372

of 3,515 researchers

Vulns

Critical1

High6

Medium5

Low0

Affected Assets

2plugins7themes

Avg CVSS

7.1

Average score of vulnerabilities

Researcher Submissions

12 records


2025-07-10 00:00	Traveler < 3.2.2 - Unauthenticated SQL Injection Travel Booking WordPress Theme < 3.2.2	`CVE-2025-52714`	7.5 High	Frank	Yes
2025-07-08 00:00	Nuss <= 1.3.3 - Missing Authorization Nuss - Hotel Booking WordPress <= 1.3.3	`CVE-2025-52804`	5.3 Medium	Frank	No
2025-07-08 00:00	Sala <= 1.1.3 - Missing Authorization Sala - Startup & SaaS WordPress Theme <= 1.1.3	`CVE-2025-52803`	5.3 Medium	Frank	No
2025-07-08 00:00	WPGYM <= 65.0 - Authenticated (Subscriber+) SQL Injection WPGYM - Wordpress Gym Management System <= 65.0	`CVE-2025-32574`	6.5 Medium	Frank	No
2025-06-30 00:00	LMS <= 9.2 - Unauthenticated SQL Injection LMS - Education WordPress Theme <= 9.2	`CVE-2025-52833`	7.5 High	Frank	Yes
2025-06-30 00:00	LogisticsHub <= 1.1.6 - Unauthenticated Arbitrary File Upload LogisticsHub - Logistics… <= 1.1.6	`CVE-2025-30933`	9.8 Critical	Frank	No
2025-06-26 00:00	Red Art <= 3.8 - Authenticated (Subscriber+) PHP Object Injection Red Art <= 3.8	`CVE-2025-52828`	8.8 High	Frank	Yes
2025-06-24 00:00	Homey <= 2.4.5 - Unauthenticated SQL Injection Homey <= 2.4.5	`CVE-2025-52834`	7.5 High	Frank	No
2025-06-23 00:00	Sala <= 1.1.3 - Authenticated (Subscriber+) PHP Object Injection Sala - Startup & SaaS WordPress Theme <= 1.1.3	`CVE-2025-52826`	7.5 High	Frank	No
2025-06-23 00:00	LMS <= 9.2 - Reflected Cross-Site Scripting LMS - Education WordPress Theme <= 9.2	`CVE-2025-52799`	6.1 Medium	Frank	Yes

Showing 1–10 of 12 reports