lucsob

lucsob is a security researcher credited with 12 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #386 of 3,515 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 3 of their findings (25%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization. The average CVSS score across these disclosures is 5.1, peaking at 7.2. Severity breakdown: 0 critical and 1 high.

The most affected software includes Appointment Booking Plugin (1), Disable Admin Notices (1), JetBackup (1), across 12 distinct plugins, themes and core versions in total.

All 12 disclosed issues have since received a vendor fix.

2026

Critical

High

Medium

Low

Global Rank

#386

of 3,515 researchers

Vulns

Critical0

High1

Medium11

Low0

Affected Assets

12plugins

Avg CVSS

5.1

Average score of vulnerabilities

Researcher Submissions

12 records


2026-08-04 17:42	Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting Super Progressive Web Apps <= 2.2.43	`CVE-2026-5108`	4.4 Medium	lucsob	Yes
2026-07-27 20:36	Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery Media Cleaner <= 7.0.3	`CVE-2026-4912`	4.1 Medium	lucsob	Yes
2026-07-16 13:18	Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title Smart Custom Fields <= 5.0.7	`CVE-2026-2594`	6.4 Medium	lucsob	Yes
2026-04-16 15:21	JetBackup <= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter JetBackup <= 3.1.19.8	`CVE-2026-4853`	4.9 Medium	lucsob	Yes
2026-04-03 19:45	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload Kadence Blocks <= 3.6.3	`CVE-2026-2826`	4.3 Medium	lucsob	Yes
2026-03-10 11:29	LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting Appointment Booking Plugin <= 5.2.7	`CVE-2026-2324`	6.1 Medium	lucsob	Yes
2026-03-03 22:00	Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor Seraphinite Accelerator <= 2.28.14	`CVE-2026-3058`	4.3 Medium	lucsob	Yes
2026-03-02 12:35	Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload Uncanny Automator <= 7.0.0.3	`CVE-2026-2269`	7.2 High	lucsob	Yes
2026-02-24 20:56	Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update Disable Admin Notices <= 1.4.2	`CVE-2026-2410`	4.3 Medium	lucsob	Yes
2026-02-24 20:06	Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload Responsive Lightbox & Gallery <= 2.7.1	`CVE-2026-2479`	5.0 Medium	lucsob	Yes

Showing 1–10 of 12 reports