Jorge Diaz (ddiax)

Jorge Diaz (ddiax) is a security researcher credited with 9 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #500 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2024, with 7 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 6 of their findings (67%). Other recurring categories include SQL Injection, Improper Neutralization Of Script-Related HTML Tags In A Web Page (Basic XSS). The average CVSS score across these disclosures is 5.0, peaking at 6.1.

The most affected software includes Breeze Cache (1), Flipping Cards (1), MC4WP (1), across 9 distinct plugins, themes and core versions in total.

All 9 disclosed issues have since received a vendor fix.

20242025

Critical

High

Medium

Low

Global Rank

#500

of 3,515 researchers

Vulns

Critical0

High0

Medium9

Low0

Affected Assets

9plugins

Avg CVSS

5.0

Average score of vulnerabilities

Researcher Submissions

9 records


2025-02-03 00:00	Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting Stylish Google Sheet Reader <= 4.0	`CVE-2025-22651`	6.1 Medium	Jorge Diaz (ddiax)	Yes
2025-01-03 00:00	ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting ProductDyno <= 1.0.24	`CVE-2025-22320`	6.1 Medium	Jorge Diaz (ddiax)	Yes
2024-11-15 00:00	Premium Packages <= 6.0.5 - Authenticated (Administrator+) SQL Injection Premium Packages <= 6.0.5	`CVE-2024-52435`	4.9 Medium	Jorge Diaz (ddiax)	Yes
2024-09-26 00:00	WPExperts Square For GiveWP <= 1.3 - Authenticated (Administrator+) SQL Injection WPExperts Square For GiveWP <= 1.3	`CVE-2024-47338`	4.9 Medium	Jorge Diaz (ddiax)	Yes
2024-09-26 00:00	Terms descriptions <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting Terms descriptions <= 3.4.7	`CVE-2024-47336`	4.4 Medium	Jorge Diaz (ddiax)	Yes
2024-09-23 00:00	Multipurpose Ticket Booking Manager <= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting Multipurpose Ticket Booking Manager… <= 4.2.2	`CVE-2024-44037`	4.4 Medium	Jorge Diaz (ddiax)	Yes
2024-09-20 20:24	MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting MC4WP <= 4.9.16	`CVE-2024-8680`	4.4 Medium	Jorge Diaz (ddiax)	Yes
2024-09-12 00:00	Flipping Cards <= 1.30 - Authenticated (Administrator+) Stored Cross-Site Scripting Flipping Cards <= 1.30	`CVE-2024-45460`	4.4 Medium	Jorge Diaz (ddiax)	Yes
2024-03-25 00:00	Breeze <= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via breeze_api_token Breeze Cache <= 2.1.3	`CVE-2024-27188`	5.5 Medium	Jorge Diaz (ddiax)	Yes

Showing 1–9 of 9 reports