Nabil Irawan

Nabil Irawan is a security researcher credited with 756 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #5 of 3,878 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 514 findings.

Their research concentrates on Missing Authorization, which accounts for 238 of their findings (31%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.0, peaking at 9.8. Severity breakdown: 8 critical and 36 high.

The most affected software includes DoFollow Case by Case (3), Hesabfa Accounting (3), Reuters Direct (3), across 717 distinct plugins, themes and core versions in total.

391 of the 756 disclosed issues have a vendor fix, while 365 remain unpatched. The most severe finding, "TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

of 3,878 researchers

Vulns

756

Critical8

High36

Medium710

Low2

Affected Assets

717

708plugins9themes

Avg CVSS

5.0

Average score of vulnerabilities

Researcher Submissions

756 records


2026-10-13 19:37	PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting PeproDev Branches Map (Mapify) <= 3.0.1	`CVE-2025-9373`	6.4 Medium	Nabil Irawan	Yes
2026-10-02 17:45	WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI WPFront Notification Bar <= 3.5.1	`CVE-2026-93896`	6.1 Medium	Nabil Irawan	Yes
2026-09-29 20:25	ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter ReactPress <= 3.4.0	`CVE-2026-92712`	6.4 Medium	Nabil Irawan	No
2026-09-21 18:48	RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action RW Elephant Rental Inventory <= 2.3.13	`CVE-2026-4123`	4.3 Medium	Nabil Irawan	Yes
2026-09-18 19:27	The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter The Welcomizer <= 2.8.1	`CVE-2026-4327`	8.8 High	Nabil Irawan	Yes
2026-09-09 14:49	Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter Sidebar Manager Light <= 1.18	`CVE-2026-76562`	7.2 High	Nabil Irawan	No
2026-09-08 18:37	Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Checkout Custom Fields Builder… <= 1.1.5	`CVE-2026-19802`	4.3 Medium	Nabil Irawan	Yes
2026-09-08 13:43	Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter Contact Form to DB by BestWebSoft <= 1.7.5	`CVE-2026-13359`	7.2 High	Nabil Irawan	Yes
2026-09-07 00:00	Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter Zephyr Project Manager <= 3.3.205	`CVE-2026-76931`	6.4 Medium	Nabil Irawan	Yes
2026-08-19 00:00	Pay with Contact Form 7 <= 1.0.4 - Unauthenticated Information Exposure Pay with Contact Form 7 <= 1.0.4	`CVE-2026-73384`	5.3 Medium	Nabil Irawan	No

Showing 1–10 of 250 reports

Showing the 250 most recent of 756 records. Every record has its own page and is listed in the sitemap.