Jerome Bruandet

Jerome Bruandet is a security researcher credited with 212 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #42 of 3,515 contributors. Their disclosures were published between 2016 and 2023. The most productive year was 2021, with 89 findings.

Their research concentrates on Cross-Site Request Forgery (CSRF), which accounts for 73 of their findings (34%). Other recurring categories include Missing Authorization, Cross-Site Scripting. The average CVSS score across these disclosures is 6.5, peaking at 9.9. Severity breakdown: 32 critical and 55 high.

The most affected software includes Directory Listings WordPress plugin (9), Frontend File Manager Plugin (8), WP Quick FrontEnd Editor (4), across 164 distinct plugins, themes and core versions in total.

191 of the 212 disclosed issues have a vendor fix, while 21 remain unpatched. The most severe finding, "Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change", scores 9.9 out of 10.

20162017201820192020202120222023

Critical

High

Medium

Low

Global Rank

#42

of 3,515 researchers

Vulns

212

Critical32

High55

Medium125

Low0

Affected Assets

241

217plugins24themes

Avg CVSS

6.5

Average score of vulnerabilities

Researcher Submissions

212 records


2023-10-25 00:00	Deeper Comments <= 2.1.1 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Options Update Deeper Comments <= 2.1.1	`N/A`	8.8 High	Jerome Bruandet	No
2023-06-03 00:00	B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification B2BKing <= 4.6.00	`CVE-2023-3125`	6.5 Medium	Jerome Bruandet	Yes
2023-06-03 00:00	B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure B2BKing <= 4.6.00	`CVE-2023-3126`	4.3 Medium	Jerome Bruandet	Yes
2023-03-28 00:00	Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option Elementor Website Builder Pro <= 3.11.6	`CVE-2023-3124`	8.8 High	Jerome Bruandet	Yes
2022-11-28 00:00	FlyingPress <= 3.9.6 - Missing Authorization FlyingPress <= 3.9.6	`CVE-2022-4948`	4.3 Medium	Jerome Bruandet	Yes
2022-04-04 00:00	Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation Event Countdown for The Events Calendar <= 1.3.1	`CVE-2022-4950`	8.8 High	Jerome Bruandet	Yes
2022-01-25 00:00	AdSanity < 1.8.2 - Authenticated Arbitrary File Upload AdSanity < 1.8.2	`CVE-2022-4949`	8.8 High	Jerome Bruandet	Yes
2021-11-12 00:00	WordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Upload WP Popular Posts <= 5.3.2	`CVE-2021-42362`	8.8 High	Jerome Bruandet	Yes
2021-10-28 00:00	uListing <= 1.6.6 - Unauthenticated SQL Injection Directory Listings WordPress plugin < 1.7	`CVE-2021-4340`	9.8 Critical	Jerome Bruandet	Yes
2021-10-05 00:00	JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Change JobSearch WP Job Board <= 1.8.1	`CVE-2021-4352`	5.3 Medium	Jerome Bruandet	Yes

Showing 1–10 of 212 reports