ISMAILSHADOW

ISMAILSHADOW is a security researcher credited with 15 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #360 of 3,899 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 10 findings.

Their research concentrates on Code Injection, which accounts for 2 of their findings (13%). Other recurring categories include Cross-Site Scripting, Missing Authorization. The average CVSS score across these disclosures is 7.4, peaking at 9.8. Severity breakdown: 1 critical and 8 high.

The most affected software includes AI Engine (4), Better Find and Replace (1), Brevo (1), across 12 distinct plugins, themes and core versions in total.

All 15 disclosed issues have since received a vendor fix. The most severe finding, "Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#360

of 3,899 researchers

Vulns

Critical1

High8

Medium6

Low0

Affected Assets

12plugins

Avg CVSS

7.4

Average score of vulnerabilities

Researcher Submissions

15 records


2026-05-27 14:54	Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF Login No Captcha reCAPTCHA <= 1.8.0	`CVE-2026-2374`	7.2 High	ISMAILSHADOW	Yes
2026-04-01 16:50	MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir MW WP Form <= 5.1.0	`CVE-2026-4347`	8.1 High	ISMAILSHADOW	Yes
2026-03-20 08:36	Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process Kali Forms <= 2.4.9	`CVE-2026-3584`	9.8 Critical	ISMAILSHADOW	Yes
2026-02-17 00:00	Brevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling Brevo <= 3.3.0	`CVE-2025-14799`	6.5 Medium	ISMAILSHADOW	Yes
2026-02-05 00:53	GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css Greenshift <= 12.6	`CVE-2026-1927`	5.4 Medium	ISMAILSHADOW	Yes
2025-12-17 23:41	Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File Hummingbird Performance <= 3.18.0	`CVE-2025-14437`	7.5 High	ISMAILSHADOW	Yes
2025-12-02 14:05	Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion Modula Image Gallery 2.13.1 – 2.13.2	`CVE-2025-13645`	7.2 High	ISMAILSHADOW	Yes
2025-11-26 00:00	Blubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post' PowerPress Podcasting plugin by Blubrry <= 11.15.2	`CVE-2025-13536`	8.8 High	ISMAILSHADOW	Yes
2025-11-12 00:00	AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization AI Engine <= 3.1.8	`CVE-2025-12844`	7.1 High	ISMAILSHADOW	Yes
2025-11-07 00:00	Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection Better Find and Replace <= 1.7.7	`CVE-2025-9334`	8.8 High	ISMAILSHADOW	Yes

Showing 1–10 of 15 reports