Lucio Sá
Lucio Sá is a security researcher credited with 348 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #20 of 3,515 contributors. Their disclosures were published between 2021 and 2025. The most productive year was 2024, with 244 findings.
Their research concentrates on Missing Authorization, which accounts for 226 of their findings (65%). Other recurring categories include Cross-Site Scripting, SQL Injection. The average CVSS score across these disclosures is 6.1, peaking at 9.9. Severity breakdown: 21 critical and 77 high.
The most affected software includes EventPrime (7), Beyot Framework (3), Civi - Job Board & Freelance… (3), across 283 distinct plugins, themes and core versions in total.
285 of the 348 disclosed issues have a vendor fix, while 63 remain unpatched. The most severe finding, "WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection", scores 9.9 out of 10.
#20
of 3,515 researchers
348
331
6.1
Average score of vulnerabilities
Researcher Submissions
Showing the 250 most recent of 348 records. Every record has its own page and is listed in the sitemap.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C