Jonah Burgess (CryptoCat)

Jonah Burgess (CryptoCat) is a security researcher credited with 24 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #245 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 12 of their findings (50%). Other recurring categories include SQL Injection, Missing Authorization. The average CVSS score across these disclosures is 6.4, peaking at 8.8. Severity breakdown: 0 critical and 7 high.

The most affected software includes ProfileGrid (3), Better Messages (2), Essential Addons for Elementor (2), across 20 distinct plugins, themes and core versions in total.

All 24 disclosed issues have since received a vendor fix. The most severe finding, "Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection", scores 8.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#245

of 3,823 researchers

Vulns

Critical0

High7

Medium17

Low0

Affected Assets

20plugins

Avg CVSS

6.4

Average score of vulnerabilities

Researcher Submissions

24 records


2026-10-16 14:40	User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() User Registration & Membership <= 5.2.8	`CVE-2026-92978`	4.3 Medium	Jonah Burgess (CryptoCat)	Yes
2026-10-13 15:09	Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter Form Maker by 10Web <= 1.15.48	`CVE-2026-95808`	7.5 High	Jonah Burgess (CryptoCat)	Yes
2026-10-09 17:02	Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action Booking Calendar <= 11.4.3	`CVE-2026-18496`	5.3 Medium	Jonah Burgess (CryptoCat)	Yes
2026-09-24 18:54	User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field User Profile Builder <= 4.0.2	`CVE-2026-95866`	7.2 High	Jonah Burgess (CryptoCat)	Yes
2026-09-24 18:18	GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') GeoDirectory <= 2.8.181	`CVE-2026-93897`	6.4 Medium	Jonah Burgess (CryptoCat)	Yes
2026-09-21 19:01	wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie wpForo Forum <= 3.1.5	`CVE-2026-91092`	4.3 Medium	Jonah Burgess (CryptoCat)	Yes
2026-09-18 13:53	Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register Better Messages <= 2.15.33	`CVE-2026-89093`	5.3 Medium	Jonah Burgess (CryptoCat)	Yes
2026-09-17 18:48	WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter WCFM Marketplace <= 3.8.2	`CVE-2026-18442`	7.5 High	Jonah Burgess (CryptoCat)	Yes
2026-09-17 09:14	Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover Booking for Appointments and Events… <= 2.4.4	`CVE-2026-14311`	5.4 Medium	Jonah Burgess (CryptoCat)	Yes
2026-09-15 15:29	Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter Better Messages <= 2.15.22	`CVE-2026-18555`	6.1 Medium	Jonah Burgess (CryptoCat)	Yes

Showing 1–10 of 24 reports