Lenon Leite

Lenon Leite is a security researcher credited with 35 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #166 of 3,515 contributors. Their disclosures were published between 2016 and 2026. The most productive year was 2016, with 14 findings.

Their research concentrates on SQL Injection, which accounts for 29 of their findings (83%). Other recurring categories include External Control Of File Name Or Path, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 7.8, peaking at 9.8. Severity breakdown: 6 critical and 22 high.

The most affected software includes Hermit 音乐播放器 (2), Simple Personal Message (2), [GWA] AutoResponder (1), across 33 distinct plugins, themes and core versions in total.

14 of the 35 disclosed issues have a vendor fix, while 21 remain unpatched. The most severe finding, "Hermit 音乐播放器 <= 3.1.6 - Unauthenticated SQL Injection", scores 9.8 out of 10.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Global Rank

#166

of 3,515 researchers

Vulns

Critical6

High22

Medium7

Low0

Affected Assets

34plugins43themes

Avg CVSS

7.8

Average score of vulnerabilities

Researcher Submissions

35 records


2026-06-09 00:00	Simple Personal Message <= 1.0.3 - Authenticated (Subscriber+) SQL Injection Simple Personal Message <= 1.0.3	`CVE-2016-20063`	6.5 Medium	Lenon Leite	No
2022-07-19 00:00	Homepage Product Organizer for WooCommerce <= 1.1 - Authenticated (Subscriber+) SQL Injection Homepage Product Organizer… <= 1.1	`CVE-2022-30998`	8.8 High	Lenon Leite	No
2022-04-28 12:22	Hermit 音乐播放器 <= 3.1.6 - Unauthenticated SQL Injection Hermit 音乐播放器 <= 3.1.6	`CVE-2022-29411`	9.8 Critical	Lenon Leite	No
2022-04-28 12:01	Hermit 音乐播放器 <= 3.1.6 - Authenticated (Subscriber+) SQL Injection Hermit 音乐播放器 <= 3.1.6	`CVE-2022-29410`	8.8 High	Lenon Leite	No
2022-04-25 00:00	3xSocializer <= 0.98.22 - Authenticated SQL Injection 3xSocializer <= 0.98.22	`CVE-2022-29419`	8.8 High	Lenon Leite	No
2022-01-27 00:00	[GWA] AutoResponder <= 2.3 - Unauthenticated SQL Injection [GWA] AutoResponder <= 2.3	`CVE-2021-44779`	7.3 High	Lenon Leite	No
2021-10-06 19:17	AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload The Monday <= 1.4.1	`CVE-2021-39317`	8.8 High	Chloe Chamberland	No
2020-12-04 00:00	Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection Profile Builder Pro < 3.3.3	`N/A`	8.8 High	Lenon Leite	Yes
2020-11-19 00:00	Contextual Related Posts <= 2.9.3 - Cross-Site Request Forgery Contextual Related Posts <= 2.9.3	`N/A`	4.3 Medium	Lenon Leite	Yes
2020-10-22 00:00	Advanced Booking Calendar <= 1.6.1 - Unauthenticated SQL Injection Advanced Booking Calendar < 1.6.2	`N/A`	9.8 Critical	Lenon Leite	Yes

Showing 1–10 of 35 reports