Itthidej Aramsri (Boeing777)

Itthidej Aramsri (Boeing777) is a security researcher credited with 115 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #67 of 3,899 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 101 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 53 of their findings (46%). Other recurring categories include Missing Authorization, SQL Injection. The average CVSS score across these disclosures is 6.6, peaking at 9.8. Severity breakdown: 6 critical and 30 high.

The most affected software includes Beaver Builder Page Builder (2), Contextual Related Posts (2), Customer Reviews for WooCommerce (2), across 104 distinct plugins, themes and core versions in total.

103 of the 115 disclosed issues have a vendor fix, while 12 remain unpatched. The most severe finding, "Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#67

of 3,899 researchers

Vulns

115

Critical6

High30

Medium79

Low0

Affected Assets

104

103plugins1theme

Avg CVSS

6.6

Average score of vulnerabilities

Researcher Submissions

115 records


2026-10-15 14:40	WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute Dark Mode <= 5.3.17	`CVE-2026-93535`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-10-14 16:23	PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter PhastPress <= 3.10	`CVE-2026-3712`	7.3 High	Itthidej Aramsri (Boeing777)	Yes
2026-09-23 20:44	WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content WP Multilang <= 2.4.31	`CVE-2026-15731`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-09-21 16:46	Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter Contextual Related Posts <= 4.4.1	`CVE-2026-85653`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-09-18 19:47	YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input YS LeadGen <= 2.1.4	`CVE-2026-1256`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-09-18 19:31	Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting Wow Elements Addons for Elementor <= 1.11.2	`CVE-2026-1641`	6.5 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-09-18 18:45	Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure Bread <= 2.9.12	`CVE-2026-4792`	5.3 Medium	Itthidej Aramsri (Boeing777)	Yes
2026-09-17 18:47	VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta VK All in One Expansion Unit <= 9.118.0	`CVE-2026-17586`	6.4 Medium	Kyokito	Yes
2026-09-17 11:24	Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter Brizy <= 2.8.14	`CVE-2026-2585`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2026-09-08 00:00	Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting Graphina <= 3.1.11	`CVE-2026-13709`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes

Showing 1–10 of 115 reports