Hiro

Hiro is a security researcher credited with 19 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #307 of 3,878 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2025, with 17 findings.

Their research concentrates on Missing Authorization, which accounts for 9 of their findings (47%). Other recurring categories include SQL Injection, Cross-Site Scripting. The average CVSS score across these disclosures is 5.8, peaking at 8.8. Severity breakdown: 0 critical and 4 high.

The most affected software includes Custom API for WP (2), App Builder (1), Dynamic User Directory (1), across 18 distinct plugins, themes and core versions in total.

13 of the 19 disclosed issues have a vendor fix, while 6 remain unpatched. The most severe finding, "Custom API for WP <= 4.2.2 - Authenticated (Subscriber+) Privilege Escalation", scores 8.8 out of 10.