Ivaylo

Ivaylo is a security researcher credited with 11 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #440 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 8 of their findings (73%). Other recurring categories include Missing Authorization, SQL Injection. The average CVSS score across these disclosures is 6.8, peaking at 8.1. Severity breakdown: 0 critical and 7 high.

The most affected software includes AcyMailing (1), Advanced Classifieds & Directory Pro (1), Better Messages (1), across 11 distinct plugins, themes and core versions in total.

All 11 disclosed issues have since received a vendor fix. The most severe finding, "Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter", scores 8.1 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#440

of 3,823 researchers

Vulns

Critical0

High7

Medium4

Low0

Affected Assets

11plugins

Avg CVSS

6.8

Average score of vulnerabilities

Researcher Submissions

11 records


2026-10-12 19:03	AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter AcyMailing <= 11.1.0	`CVE-2026-102562`	7.2 High	Ivaylo	Yes
2026-10-09 17:26	Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook Podlove Podcast Publisher <= 4.5.6	`CVE-2026-93775`	7.2 High	Ivaylo	Yes
2026-10-09 14:24	Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter Advanced Classifieds & Directory Pro <= 3.4.4	`CVE-2026-93883`	6.4 Medium	Ivaylo	Yes
2026-10-02 17:19	Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter Photo Reviews for WooCommerce <= 1.2.30	`CVE-2026-101923`	8.1 High	Ivaylo	Yes
2026-10-01 18:39	CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type CMB2 <= 2.13.0	`CVE-2026-97336`	7.2 High	Ivaylo	Yes
2026-09-24 19:09	wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field wpForo Forum <= 3.1.6	`CVE-2026-93747`	6.4 Medium	Ivaylo	Yes
2026-09-24 18:12	Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter Better Messages <= 3.0.4	`CVE-2026-93899`	6.5 Medium	Ivaylo	Yes
2026-09-21 19:00	WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) WP Yelp Review Slider <= 9.2	`CVE-2026-93778`	7.2 High	Ivaylo	Yes
2026-09-08 16:50	WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter WPBot <= 8.7.3	`CVE-2026-83593`	7.2 High	Ivaylo	Yes
2026-08-14 15:08	Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter Invisible Anti-Spam & CAPTCHA <= 5.1	`CVE-2026-16145`	7.2 High	Ivaylo	Yes

Showing 1–10 of 11 reports