gidget smith

gidget smith is a security researcher credited with 4 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #1,004 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 2 of their findings (50%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Missing Authorization. The average CVSS score across these disclosures is 6.0, peaking at 7.2. Severity breakdown: 0 critical and 1 high.

The most affected software includes Appointment Booking Plugin (1), Custom Twitter Feeds (1), Media Library Assistant (1), across 4 distinct plugins, themes and core versions in total.

All 4 disclosed issues have since received a vendor fix.

2026

Critical

High

Medium

Low

Global Rank

#1004

of 3,823 researchers

Vulns

Critical0

High1

Medium3

Low0

Affected Assets

4plugins

Avg CVSS

6.0

Average score of vulnerabilities

Researcher Submissions

4 records


2026-09-10 00:00	Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter Media Library Assistant <= 3.35	`CVE-2026-6641`	6.4 Medium	gidget smith	Yes
2026-07-23 18:32	Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret Payment Plugins for Stripe WooCommerce <= 4.0.7	`CVE-2026-12654`	5.3 Medium	gidget smith	Yes
2026-07-01 20:02	LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter Appointment Booking Plugin <= 5.6.2	`CVE-2026-12657`	5.3 Medium	gidget smith	Yes
2026-05-12 00:00	Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text Custom Twitter Feeds <= 2.5.4	`CVE-2026-6177`	7.2 High	gidget smith	Yes

Showing 1–4 of 4 reports