Leonid Semenenko (lsemenenko)

Leonid Semenenko (lsemenenko) is a security researcher credited with 14 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #375 of 3,878 contributors. The disclosure was published in 2026.

Their research concentrates on SQL Injection, which accounts for 7 of their findings (50%). Other recurring categories include External Control Of File Name Or Path, Path Traversal. The average CVSS score across these disclosures is 7.6, peaking at 8.8. Severity breakdown: 0 critical and 12 high.

The most affected software includes wpForo Forum (3), Betheme (2), Motors (2), across 10 distinct plugins, themes and core versions in total.

All 14 disclosed issues have since received a vendor fix. The most severe finding, "Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload", scores 8.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#375

of 3,878 researchers

Vulns

Critical0

High12

Medium2

Low0

Affected Assets

9plugins1theme

Avg CVSS

7.6

Average score of vulnerabilities

Researcher Submissions

14 records


2026-09-29 19:37	Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters Motors <= 1.4.109	`CVE-2026-6806`	7.5 High	Leonid Semenenko (lsemenenko)	Yes
2026-08-27 00:00	wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter wpForo Forum <= 2.4.17	`CVE-2026-5097`	7.5 High	Leonid Semenenko (lsemenenko)	Yes
2026-07-07 23:19	My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters My Calendar <= 3.7.8	`CVE-2026-6854`	7.5 High	Leonid Semenenko (lsemenenko)	Yes
2026-07-06 00:00	AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload AMP for WP <= 1.1.12	`CVE-2026-6101`	7.5 High	Leonid Semenenko (lsemenenko)	Yes
2026-05-18 00:00	Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection Contest Gallery <= 28.1.6	`CVE-2026-8912`	7.5 High	Leonid Semenenko (lsemenenko)	Yes
2026-05-13 18:03	Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter Motors <= 1.4.107	`CVE-2026-3892`	8.1 High	Leonid Semenenko (lsemenenko)	Yes
2026-05-04 22:35	Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload Betheme <= 28.4	`CVE-2026-6261`	8.8 High	Webbernaut	Yes
2026-05-04 21:38	Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' Betheme <= 28.4	`CVE-2026-6262`	6.5 Medium	Webbernaut	Yes
2026-05-01 19:15	Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter Geo Mashup <= 1.13.19	`CVE-2026-6457`	6.5 Medium	Leonid Semenenko (lsemenenko)	Yes
2026-04-17 04:37	Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass Drag and Drop Multiple File Upload… <= 1.3.9.7	`CVE-2026-5718`	8.1 High	Leonid Semenenko (lsemenenko)	Yes

Showing 1–10 of 14 reports