iohex

iohex is a security researcher credited with 28 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #196 of 3,515 contributors. Their disclosures were published between 2021 and 2023. The most productive year was 2022, with 16 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 28 of their findings (100%). The average CVSS score across these disclosures is 5.7, peaking at 6.4.

The most affected software includes Advanced Booking Calendar (2), WordPress Flipbook by Supsystic (2), Accept Stripe Payments (1), across 26 distinct plugins, themes and core versions in total.

25 of the 28 disclosed issues have a vendor fix, while 3 remain unpatched.

202120222023

Critical

High

Medium

Low

Global Rank

#196

of 3,515 researchers

Vulns

Critical0

High0

Medium28

Low0

Affected Assets

74plugins

Avg CVSS

5.7

Average score of vulnerabilities

Researcher Submissions

28 records


2023-06-05 00:00	Editorial Calendar <= 3.8.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via edcal_saveoptions AJAX action Editorial Calendar <= 3.8.0	`CVE-2022-4115`	6.4 Medium	iohex	Yes
2022-12-23 00:00	Link Library <= 7.4 - Authenticated (Admin+) Stored Cross-Site Scripting Link Library <= 7.4	`CVE-2022-4199`	5.5 Medium	iohex	Yes
2022-12-21 00:00	WP Attachments <= 5.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting WP Attachments <= 5.0.5	`CVE-2022-4330`	5.5 Medium	iohex	Yes
2022-12-09 00:00	Image Optimizer, Resizer and CDN – Sirv <= 6.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting Image Optimizer, Resizer and CDN <= 6.8.0	`CVE-2022-4119`	5.5 Medium	iohex	Yes
2022-12-07 00:00	Login with Cognito <= 1.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting Login with Cognito <= 1.4.8	`CVE-2022-4200`	5.5 Medium	iohex	Yes
2022-12-06 00:00	WordPress Filter Gallery Plugin <= 0.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting Filter Gallery <= 0.1.5	`CVE-2022-4142`	5.5 Medium	iohex	Yes
2022-12-06 00:00	WP-Ban <= 1.69 - Authenticated (Administrator+) Stored Cross-Site Scripting WP-Ban <= 1.69	`CVE-2022-4260`	5.5 Medium	iohex	Yes
2022-12-06 00:00	All-in-One Addons for Elementor - WidgetKit <= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting WidgetKit for Elementor <= 2.4.3	`CVE-2022-4256`	5.5 Medium	iohex	Yes
2022-12-02 00:00	ImageInject <= 1.18 - Authenticated (Admin+) Stored XSS ImageInject <= 1.18	`CVE-2022-4243`	5.5 Medium	iohex	No
2022-12-02 00:00	WP Google Review Slider <= 11.5 - Authenticated (Administrator+) Stored Cross-Site Scripting WP Google Review Slider <= 11.5	`CVE-2022-4242`	5.5 Medium	iohex	Yes

Showing 1–10 of 28 reports