Miguel Santareno

Miguel Santareno is a security researcher credited with 14 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #349 of 3,515 contributors. Their disclosures were published between 2023 and 2026. The most productive year was 2023, with 8 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 8 of their findings (57%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 5.2, peaking at 7.5. Severity breakdown: 0 critical and 1 high.

The most affected software includes EventON (5), EventPrime (4), Welcart e-Commerce (2), across 6 distinct plugins, themes and core versions in total.

All 14 disclosed issues have since received a vendor fix.

2023202420252026

Critical

High

Medium

Low

Global Rank

#349

of 3,515 researchers

Vulns

Critical0

High1

Medium12

Low1

Affected Assets

7plugins

Avg CVSS

5.2

Average score of vulnerabilities

Researcher Submissions

14 records


2026-02-17 17:14	Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings Membership Plugin <= 3.2.18	`CVE-2026-1304`	4.4 Medium	Miguel Santareno	Yes
2025-10-21 17:22	Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail Welcart e-Commerce <= 2.11.22	`CVE-2025-10651`	5.5 Medium	Miguel Santareno	Yes
2025-09-15 16:24	The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure The Events Calendar <= 6.15.2	`CVE-2025-9808`	5.3 Medium	Miguel Santareno	Yes
2025-09-09 18:30	Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting Welcart e-Commerce <= 2.11.20	`CVE-2025-9367`	5.5 Medium	Miguel Santareno	Yes
2024-09-09 00:00	EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure EventPrime <= 4.0.4.3	`CVE-2024-8369`	5.3 Medium	Miguel Santareno	Yes
2024-01-10 00:00	EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting EventON <= 2.2.7	`CVE-2023-6005`	4.4 Medium	Miguel Santareno	Yes
2023-12-29 00:00	EventPrime <= 3.3.5 - Missing Authorization to Private Event Disclosure EventPrime <= 3.3.5	`CVE-2023-6447`	5.3 Medium	Miguel Santareno	Yes
2023-11-09 00:00	EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection EventON <= 2.1.7	`CVE-2023-6046`	3.0 Low	Miguel Santareno	Yes
2023-10-09 00:00	EventPrime < 3.2.0 - Reflected Cross-Site Scripting via keyword and ep_filter_date EventPrime < 3.2.0	`CVE-2023-4250`	6.1 Medium	Miguel Santareno	Yes
2023-10-09 00:00	EventPrime < 3.2.0 - Reflected HTML Content Injection EventPrime < 3.2.0	`CVE-2023-5238`	4.3 Medium	Miguel Santareno	Yes

Showing 1–10 of 14 reports