Haitam Lazaar

Haitam Lazaar is a security researcher credited with 14 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #381 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Authorization Bypass Through User-Controlled Key, which accounts for 4 of their findings (29%). Other recurring categories include Missing Authorization, Cross-Site Scripting. The average CVSS score across these disclosures is 5.7, peaking at 7.3. Severity breakdown: 0 critical and 3 high.

The most affected software includes Booking for Appointments and Events… (2), Events Made Easy (2), Eventin (1), across 12 distinct plugins, themes and core versions in total.

All 14 disclosed issues have since received a vendor fix.

2026

Critical

High

Medium

Low

Global Rank

#381

of 3,823 researchers

Vulns

Critical0

High3

Medium11

Low0

Affected Assets

12plugins

Avg CVSS

5.7

Average score of vulnerabilities

Researcher Submissions

14 records


2026-09-01 00:00	GutenKit <= 2.5.0 - Authenticated (Contributor+) Arbitrary CSS Injection GutenKit <= 2.5.0	`CVE-2026-19698`	4.3 Medium	Haitam Lazaar	Yes
2026-08-31 00:00	Booking for Appointments and Events Calendar – Amelia < 2.4.9 - Missing Authorization Booking for Appointments and Events… < 2.4.9	`CVE-2026-14215`	5.3 Medium	Haitam Lazaar	Yes
2026-08-28 00:00	Booking for Appointments and Events Calendar – Amelia 9.0 - 9.7 - Authenticated (Provider+) Arbitrary Provider Password Update Booking for Appointments and Events… 9.0 – 9.7	`CVE-2026-14212`	6.3 Medium	Haitam Lazaar	Yes
2026-08-06 00:00	Hotel Booking Lite <= 6.2.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Customer Data Modification MotoPress Hotel Booking <= 6.2.2	`CVE-2026-15238`	4.3 Medium	Haitam Lazaar	Yes
2026-08-06 00:00	Hotel Booking Lite <= 6.2.2 - Missing Authorization MotoPress Hotel Booking <= 6.2.2	`CVE-2026-15237`	5.3 Medium	Haitam Lazaar	Yes
2026-08-05 00:00	Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation Ultimate Member < 2.12.1	`CVE-2026-12251`	7.3 High	Haitam Lazaar	Yes
2026-08-04 00:00	Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass Eventin < 4.1.16	`CVE-2026-13178`	5.3 Medium	Haitam Lazaar	Yes
2026-08-03 00:00	Newsletters <= 4.15 - Unauthenticated API Authorization Bypass via Type Juggling Newsletters <= 4.15	`CVE-2026-16269`	7.3 High	Haitam Lazaar	Yes
2026-07-13 00:00	Events Made Easy <= 3.1.3 - Insecure Direct Object Reference to Unauthenticated Person Data Modification Events Made Easy <= 3.1.3	`CVE-2026-14843`	5.3 Medium	Haitam Lazaar	Yes
2026-07-07 00:00	Events Made Easy <= 3.1.1 - Unauthenticated Payment Bypass Events Made Easy <= 3.1.1	`CVE-2026-14842`	5.3 Medium	Haitam Lazaar	Yes

Showing 1–10 of 14 reports