h0xilo
h0xilo is a security researcher credited with 45 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #139 of 3,823 contributors. The disclosure was published in 2026.
Their research concentrates on SQL Injection, which accounts for 13 of their findings (29%). Other recurring categories include Cross-Site Scripting, Improper Privilege Management. The average CVSS score across these disclosures is 7.8, peaking at 9.8. Severity breakdown: 6 critical and 29 high.
The most affected software includes Wishlist Member (4), WP Review Slider Pro (4), ARMember Premium (3), across 31 distinct plugins, themes and core versions in total.
All 45 disclosed issues have since received a vendor fix. The most severe finding, "DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow", scores 9.8 out of 10.
#139
of 3,823 researchers
45
33
7.8
Average score of vulnerabilities
Researcher Submissions
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C