LionTree

LionTree is a security researcher credited with 9 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #481 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 7 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 2 of their findings (22%). Other recurring categories include Server-Side Request Forgery (SSRF), SQL Injection. The average CVSS score across these disclosures is 6.5, peaking at 8.1. Severity breakdown: 0 critical and 4 high.

The most affected software includes AffiliateWP (1), Blog2Social (1), Element Pack Addons for Elementor (1), across 9 distinct plugins, themes and core versions in total.

All 9 disclosed issues have since received a vendor fix. The most severe finding, "Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload", scores 8.1 out of 10.