Lucas Montes (NiRoX)

20252026

Critical

High

Medium

Low

Global Rank

#238

of 3,248 researchers

Vulns

20

Critical1

High1

Medium18

Low0

Affected Assets

17

17plugins

Avg CVSS

5.8

Average score of vulnerabilities

Researcher Submissions

20 records


2026-03-27 18:10	Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token Ninja Forms <= 3.14.1	`CVE-2026-1307`	6.5 Medium	Lucas Montes (NiRoX)	Yes
2026-03-06 11:20	Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load' Greenshift <= 12.8.3	`CVE-2026-2371`	5.3 Medium	Lucas Montes (NiRoX)	Yes
2026-02-17 21:30	Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification Blog2Social <= 8.7.4	`CVE-2026-1942`	6.5 Medium	Lucas Montes (NiRoX)	Yes
2026-02-11 21:24	Converter for Media – Optimize images \| Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src Converter for Media <= 6.5.1	`CVE-2026-1356`	4.8 Medium	Lucas Montes (NiRoX)	Yes
2026-02-10 17:13	Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload WPvivid <= 0.9.123	`CVE-2026-1357`	9.8 Critical	Lucas Montes (NiRoX)	Yes
2026-01-05 15:10	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure Simply Schedule Appointments <= 1.6.9.5	`CVE-2025-11723`	6.5 Medium	Lucas Montes (NiRoX)	Yes
2025-12-16 18:41	Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token Ninja Forms <= 3.13.2	`CVE-2025-11924`	7.5 High	Lucas Montes (NiRoX)	Yes
2025-12-10 12:23	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery RSS Aggregator by Feedzy <= 5.1.1	`CVE-2025-11467`	5.8 Medium	Lucas Montes (NiRoX)	Yes
2025-11-24 15:08	Search Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API Search Exclude <= 2.5.7	`CVE-2025-10646`	4.3 Medium	Lucas Montes (NiRoX)	Yes
2025-11-20 16:53	LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure LearnPress <= 4.2.9.4	`CVE-2025-11368`	5.3 Medium	Lucas Montes (NiRoX)	Yes

Showing 1–10 of 20 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C