Kyokito

Kyokito is a security researcher credited with 4 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #1,049 of 3,878 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 3 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 4 of their findings (100%). The average CVSS score across these disclosures is 5.4, peaking at 6.4.

The most affected software includes CSS & JavaScript Toolbox (2), Master Addons for Elementor (1), VK All in One Expansion Unit (1), across 3 distinct plugins, themes and core versions in total.

All 4 disclosed issues have since received a vendor fix.

20252026

Critical

High

Medium

Low

Global Rank

#1049

of 3,878 researchers

Vulns

Critical0

High0

Medium4

Low0

Affected Assets

3plugins

Avg CVSS

5.4

Average score of vulnerabilities

Researcher Submissions

4 records


2026-09-17 19:51	CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields CSS & JavaScript Toolbox <= 12.0.6	`CVE-2025-13533`	4.4 Medium	Kyokito	Yes
2026-09-17 18:47	VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta VK All in One Expansion Unit <= 9.118.0	`CVE-2026-17586`	6.4 Medium	Kyokito	Yes
2026-06-05 12:04	Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) Master Addons for Elementor <= 3.1.0	`CVE-2026-9281`	6.4 Medium	Kyokito	Yes
2025-10-31 00:00	CSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting CSS & JavaScript Toolbox <= 12.0.5	`CVE-2025-11928`	4.4 Medium	Kyokito	Yes

Showing 1–4 of 4 reports