incognito

incognito is a security researcher credited with 16 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #323 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2024, with 9 findings.

Their research concentrates on Missing Authorization, which accounts for 15 of their findings (94%). Other recurring categories include Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 4.6, peaking at 6.4.

The most affected software includes Buy one click WooCommerce (3), Customer Reviews for WooCommerce (1), DirectoryPress Frontend (1), across 14 distinct plugins, themes and core versions in total.

11 of the 16 disclosed issues have a vendor fix, while 5 remain unpatched.

20242025

Critical

High

Medium

Low

Global Rank

#323

of 3,515 researchers

Vulns

Critical0

High0

Medium16

Low0

Affected Assets

14plugins

Avg CVSS

4.6

Average score of vulnerabilities

Researcher Submissions

16 records


2025-02-27 00:00	NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission NextMove Lite <= 2.19.0	`CVE-2024-10860`	4.3 Medium	incognito	Yes
2025-02-14 00:00	DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update DirectoryPress Frontend <= 2.7.9	`CVE-2024-10581`	4.3 Medium	incognito	Yes
2025-02-11 15:21	The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation WP Extended <= 3.0.13	`CVE-2024-13554`	5.3 Medium	incognito	Yes
2025-01-30 00:51	ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion ECPay Ecommerce for WooCommerce <= 1.1.2411060	`CVE-2024-13652`	4.3 Medium	incognito	Yes
2025-01-24 18:42	GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update GoHero Store Customizer for WooCommerce <= 3.5	`CVE-2024-12826`	4.3 Medium	incognito	Yes
2025-01-14 00:00	RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets RTMKit <= 1.5.3	`CVE-2024-10326`	4.3 Medium	Tieu Pham Trong Nhan	Yes
2025-01-08 22:07	Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting Responsive FlipBook Plugin Wordpress <= 2.5.0	`CVE-2024-11929`	6.4 Medium	Tieu Pham Trong Nhan	No
2024-12-21 12:54	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization Element Pack Addons for Elementor <= 5.10.12	`CVE-2024-11852`	4.3 Medium	Tieu Pham Trong Nhan	Yes
2024-11-15 14:58	WP Log Viewer <= 1.2.1 - Missing Authorization WP Log Viewer <= 1.2.1	`CVE-2024-11085`	5.4 Medium	Tieu Pham Trong Nhan	No
2024-11-15 00:00	Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation Customer Reviews for WooCommerce <= 5.61.0	`CVE-2024-10614`	4.3 Medium	incognito	Yes

Showing 1–10 of 16 reports