Muhammad Yudha - DJ

Muhammad Yudha - DJ is a security researcher credited with 720 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #6 of 3,867 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2025, with 560 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 630 of their findings (88%). Other recurring categories include PHP Remote File Inclusion, Improper Neutralization Of Script-Related HTML Tags In A Web Page (Basic XSS). The average CVSS score across these disclosures is 6.5, peaking at 9.8. Severity breakdown: 5 critical and 51 high.

The most affected software includes Bold Page Builder (3), Broadcast Live Video (3), Easy Email Subscription (3), across 662 distinct plugins, themes and core versions in total.

439 of the 720 disclosed issues have a vendor fix, while 281 remain unpatched. The most severe finding, "Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal", scores 9.8 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

of 3,867 researchers

Vulns

720

Critical5

High51

Medium664

Low0

Affected Assets

666

664plugins2themes

Avg CVSS

6.5

Average score of vulnerabilities

Researcher Submissions

720 records


2026-10-09 17:51	Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content ACF Frontend Admin by DynamiApps <= 3.28.36	`CVE-2026-6243`	6.4 Medium	Muhammad Yudha - DJ	Yes
2026-09-28 13:26	HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field HT Contact Form <= 2.10.2	`CVE-2026-96326`	7.2 High	Muhammad Yudha - DJ	Yes
2026-09-24 15:10	CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode CSS & JavaScript Toolbox <= 12.0.6	`CVE-2025-14814`	6.4 Medium	Muhammad Yudha - DJ	Yes
2026-09-07 00:00	Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode Live Composer <= 2.1.18	`CVE-2026-16502`	8.8 High	Muhammad Yudha - DJ	Yes
2026-09-06 00:00	Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing Powerkit <= 3.0.4	`CVE-2026-2390`	6.4 Medium	Muhammad Yudha - DJ	Yes
2026-08-25 21:26	Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes Reviews and Rating <= 5.10	`CVE-2026-2388`	6.4 Medium	Muhammad Yudha - DJ	Yes
2026-08-12 18:40	PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PPWP <= 1.9.21	`CVE-2026-3639`	6.4 Medium	Muhammad Yudha - DJ	Yes
2026-08-05 22:05	PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block Post Grid Gutenberg Blocks <= 5.0.13	`CVE-2026-5158`	6.4 Medium	Muhammad Yudha - DJ	Yes
2026-07-22 18:44	Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter Web Push Notifications <= 4.39.0	`CVE-2026-9729`	6.4 Medium	Muhammad Yudha - DJ	No
2026-07-22 18:43	WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute WP Shortcode by MyThemeShop <= 1.4.17	`CVE-2026-9635`	6.4 Medium	Muhammad Yudha - DJ	No

Showing 1–10 of 250 reports

Showing the 250 most recent of 720 records. Every record has its own page and is listed in the sitemap.