mak3bread

mak3bread is a security researcher credited with 10 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #518 of 3,985 contributors. The disclosure was published in 2026.

Their research concentrates on Improper Neutralization Of Input During Web Page Generation, which accounts for 3 of their findings (30%). Other recurring categories include Improper Neutralization Of Special Elements Used In An SQL Command, External Control Of File Name Or Path. The average CVSS score across these disclosures is 5.9, peaking at 8.1. Severity breakdown: 0 critical and 3 high.

The most affected software includes WP Import Export Lite (7), All in One SEO (1), GeoDirectory (1), across 4 distinct plugins, themes and core versions in total.

All 10 disclosed issues have since received a vendor fix. The most severe finding, "GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision", scores 8.1 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#518

of 3,985 researchers

Vulns

Critical0

High3

Medium7

Low0

Affected Assets

4plugins

Avg CVSS

5.9

Average score of vulnerabilities

Researcher Submissions

10 records


2026-10-01 20:40	All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname All in One SEO <= 5.0.1.1	`CVE-2026-85492`	6.1 Medium	mak3bread	Yes
2026-09-18 19:46	LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter LiteSpeed Cache <= 7.9	`CVE-2026-76579`	4.7 Medium	mak3bread	Yes
2026-09-17 00:00	Import Export Lite <= 3.9.34 - Authenticated (Admin+) Privilege Escalation WP Import Export Lite <= 3.9.34	`CVE-2026-76554`	4.7 Medium	mak3bread	Yes
2026-09-14 00:00	Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection WP Import Export Lite <= 3.9.32	`CVE-2026-76556`	4.9 Medium	mak3bread	Yes
2026-09-14 00:00	Import Export Lite <= 3.9.32 - Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion WP Import Export Lite <= 3.9.32	`CVE-2026-76553`	4.9 Medium	mak3bread	Yes
2026-09-14 00:00	Import Export Lite <= 3.9.32 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Import Export Lite <= 3.9.32	`CVE-2026-76558`	6.4 Medium	mak3bread	Yes
2026-09-14 00:00	Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection WP Import Export Lite <= 3.9.32	`CVE-2026-76557`	4.9 Medium	mak3bread	Yes
2026-09-14 00:00	Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Upload WP Import Export Lite <= 3.9.32	`CVE-2026-76552`	7.2 High	mak3bread	Yes
2026-09-14 00:00	Import Export Lite <= 3.9.33 - Authenticated (Admin+) Remote Code Execution WP Import Export Lite <= 3.9.33	`CVE-2026-76550`	7.2 High	mak3bread	Yes
2026-08-11 06:44	GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision GeoDirectory <= 2.8.169	`CVE-2026-19091`	8.1 High	mak3bread	Yes

Showing 1–10 of 10 reports