João Pedro Soares de Alcântara

João Pedro Soares de Alcântara is a security researcher credited with 1,010 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #1 of 3,868 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2025, with 511 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 654 of their findings (65%). Other recurring categories include PHP Remote File Inclusion, SQL Injection. The average CVSS score across these disclosures is 6.7, peaking at 9.9. Severity breakdown: 25 critical and 262 high.

The most affected software includes tagDiv Composer (5), TheGem Theme Elements (5), Travel Booking WordPress Theme (5), across 847 distinct plugins, themes and core versions in total.

482 of the 1,010 disclosed issues have a vendor fix, while 528 remain unpatched. The most severe finding, "Unite Gallery Lite <= 1.7.62 - Authenticated (Contributor+) SQL Injection", scores 9.9 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

of 3,868 researchers

Vulns

1,010

Critical25

High262

Medium723

Low0

Affected Assets

847

699plugins148themes

Avg CVSS

6.7

Average score of vulnerabilities

Researcher Submissions

1,010 records


2026-09-14 00:00	Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute Bridge - Creative Multipurpose… <= 30.8.9.1	`CVE-2026-15609`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2026-08-27 15:41	Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute Avada (Fusion) Builder <= 3.15.6	`CVE-2026-16654`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2026-08-25 00:00	Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode Betheme <= 28.4	`CVE-2026-6178`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2026-06-04 00:00	Moderno < 1.43 - Unauthenticated PHP Object Injection Moderno < 1.43	`CVE-2026-49108`	8.1 High	João Pedro Soares de Alcântara	Yes
2026-06-01 00:00	Enfold - Responsive Multi-Purpose Theme <= 7.1.4 - Reflected Cross-Site Scripting enfold <= 7.1.4	`CVE-2026-48869`	6.1 Medium	João Pedro Soares de Alcântara	Yes
2026-05-28 18:38	The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter The Plus Addons for Elementor <= 6.4.15	`CVE-2026-9243`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2026-05-28 00:00	Grand Car Rental \| Limousine HTML Template <= 3.7 - Unauthenticated Stored Cross-Site Scripting Grand Car Rental <= 3.7	`CVE-2025-69151`	7.2 High	João Pedro Soares de Alcântara	No
2026-05-27 00:00	SeedProd Pro < 6.19.5 - Authenticated (Contributor+) Local File Inclusion SeedProd Pro < 6.19.5	`CVE-2026-48972`	7.5 High	João Pedro Soares de Alcântara	Yes
2026-05-27 00:00	Roneous - Creative Multi-Purpose WordPress Theme <= 2.1.5 - Unauthenticated Local File Inclusion Roneous - Creative Multi-Purpose… <= 2.1.5	`CVE-2025-69177`	8.1 High	João Pedro Soares de Alcântara	No
2026-05-27 00:00	Truemag <= 4.3.14.2 - Unauthenticated Local File Inclusion Truemag <= 4.3.14.2	`CVE-2025-69178`	8.1 High	João Pedro Soares de Alcântara	No

Showing 1–10 of 250 reports

Showing the 250 most recent of 1,010 records. Every record has its own page and is listed in the sitemap.