João Ramos Maciel

João Ramos Maciel is a security researcher credited with 25 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #240 of 3,878 contributors. The disclosure was published in 2026.

Their research concentrates on SQL Injection, which accounts for 13 of their findings (52%). Other recurring categories include Cross-Site Scripting, Unrestricted Upload Of File With Dangerous Type. The average CVSS score across these disclosures is 7.6, peaking at 9.8. Severity breakdown: 4 critical and 15 high.

The most affected software includes Library Management System (2), Album Cover Finder (1), ASPL Product Quotation (1), across 24 distinct plugins, themes and core versions in total.

12 of the 25 disclosed issues have a vendor fix, while 13 remain unpatched. The most severe finding, "WP images upload on piclect <= 1.0 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#240

of 3,878 researchers

Vulns

Critical4

High15

Medium6

Low0

Affected Assets

24plugins

Avg CVSS

7.6

Average score of vulnerabilities

Researcher Submissions

25 records


2026-10-09 00:00	WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQL Injection WpCues Basic Quiz <= 1.6.5	`CVE-2026-89214`	7.5 High	João Ramos Maciel	No
2026-10-09 00:00	ASPL Product Quotation <= 1.1.0 - Unauthenticated SQL Injection ASPL Product Quotation <= 1.1.0	`CVE-2026-89287`	7.5 High	João Ramos Maciel	No
2026-10-09 00:00	Site Setup Wizard <= 1.5.8 - Unauthenticated SQL Injection Site Setup Wizard <= 1.5.8	`CVE-2026-89195`	7.5 High	João Ramos Maciel	No
2026-09-29 00:00	If-So Dynamic Content 1.8 - 1.10.1 - Reflected Cross-Site Scripting If-So Dynamic Content 1.8 – 1.10.1	`CVE-2026-87970`	6.1 Medium	João Ramos Maciel	Yes
2026-09-23 00:00	Bluff Post <= 1.1.1 - Unauthenticated SQL Injection Bluff Post <= 1.1.1	`CVE-2026-89237`	7.5 High	João Ramos Maciel	No
2026-09-15 00:00	Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection Yo 1.1 – 1.3.1	`CVE-2026-87963`	7.5 High	João Ramos Maciel	No
2026-09-14 00:00	Album Cover Finder <= 0.7.0 - Unauthenticated SQL Injection Album Cover Finder <= 0.7.0	`CVE-2026-84047`	7.5 High	João Ramos Maciel	No
2026-09-14 00:00	SAMO Forms <= 1.0.0 - Unauthenticated SQL Injection SAMO Forms <= 1.0.0	`CVE-2026-80491`	7.5 High	João Ramos Maciel	No
2026-09-14 00:00	WP images upload on piclect <= 1.0 - Unauthenticated Arbitrary File Upload WP images upload on piclect <= 1.0	`CVE-2026-84171`	9.8 Critical	João Ramos Maciel	No
2026-09-10 00:00	CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Deletion CODE MONKEYS PROPOSALS <= 1.0.1	`CVE-2026-77005`	8.1 High	João Ramos Maciel	No

Showing 1–10 of 25 reports