John Blackbourn

John Blackbourn is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #521 of 3,515 contributors. Their disclosures were published between 2016 and 2024. The most productive year was 2024, with 4 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 3 of their findings (38%). Other recurring categories include Authentication Bypass Using An Alternate Path Or Channel, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 6.9, peaking at 9.8. Severity breakdown: 2 critical and 2 high.

The most affected software includes Gutenberg (1), LiteSpeed Cache (1), Login As Users (1), across 8 distinct plugins, themes and core versions in total.

All 8 disclosed issues have since received a vendor fix. The most severe finding, "LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation", scores 9.8 out of 10.

201620172018201920202021202220232024

Critical

High

Medium

Low

Global Rank

#521

of 3,515 researchers

Vulns

Critical2

High2

Medium4

Low0

Affected Assets

3plugins5core versions

Avg CVSS

6.9

Average score of vulnerabilities

Researcher Submissions

8 records


2024-08-21 00:00	LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation LiteSpeed Cache <= 6.3.0.1	`CVE-2024-28000`	9.8 Critical	John Blackbourn	Yes
2024-08-16 00:00	Login As Users <= 1.4.2 - Authentication Bypass Login As Users <= 1.4.2	`CVE-2024-43311`	9.8 Critical	John Blackbourn	Yes
2024-04-09 00:00	Gutenberg 12.9.0 - 18.0.0 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block Gutenberg 12.9.0 – 18.0.0	`N/A`	6.4 Medium	John Blackbourn	Yes
2024-04-09 00:00	WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block WordPress 6.5 6.0 – 6.5.1 · 6 branches	`CVE-2024-4439`	7.2 High	John Blackbourn	Yes
2023-05-16 00:00	WordPress Core < 6.2.1 - Cross-Site Request Forgery WordPress 6.2 4.1 – < 6.2.1 · 23 branches	`N/A`	4.3 Medium	John Blackbourn	Yes
2022-08-30 00:00	WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function WordPress 6.0 3.6.1 – 6.0.1 · 25 branches	`CVE-2022-4973`	4.9 Medium	John Blackbourn	Yes
2017-01-11 00:00	WordPress Core < 4.7.1 - Authorization Bypass WordPress 4.7 3.7 – 4.7.0 · 12 branches	`CVE-2017-5491`	8.3 High	John Blackbourn	Yes
2016-06-18 00:00	WordPress Core < 4.5.3 - Revision History Disclosure WordPress 4.5 3.7 – 4.5.2 · 10 branches	`CVE-2016-5835`	4.3 Medium	John Blackbourn	Yes

Showing 1–8 of 8 reports