Nex Team

Nex Team is a security researcher credited with 12 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #373 of 3,515 contributors. Their disclosures were published between 2023 and 2024. The most productive year was 2024, with 10 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 2 of their findings (17%). Other recurring categories include Improper Input Validation, Missing Authorization. The average CVSS score across these disclosures is 6.6, peaking at 9.8. Severity breakdown: 1 critical and 3 high.

The most affected software includes Pods (3), Auto Featured Image (Auto Post… (1), Backup Migration (1), across 10 distinct plugins, themes and core versions in total.

All 12 disclosed issues have since received a vendor fix. The most severe finding, "Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution", scores 9.8 out of 10.

20232024

Critical

High

Medium

Low

Global Rank

#373

of 3,515 researchers

Vulns

Critical1

High3

Medium8

Low0

Affected Assets

10plugins

Avg CVSS

6.6

Average score of vulnerabilities

Researcher Submissions

12 records


2024-05-30 00:00	Auto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery Auto Featured Image (Auto Post… <= 4.1.7	`CVE-2023-7073`	6.4 Medium	Nex Team	Yes
2024-05-28 00:00	Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import Unlimited Elements For Elementor <= 1.5.89	`CVE-2023-6743`	8.8 High	Nex Team	Yes
2024-03-28 00:00	Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode Pods 2.7.31 – < 3.0.10.2 · 3 branches	`CVE-2023-6967`	8.8 High	Nex Team	Yes
2024-03-28 00:00	Pods - Custom Content Types and Fields - Missing Authorization Pods 2.7.31 – < 3.0.10.2 · 3 branches	`CVE-2023-6965`	4.3 Medium	Nex Team	Yes
2024-03-28 00:00	Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution Pods 2.7.31 – < 3.0.10.2 · 3 branches	`CVE-2023-6999`	8.8 High	Nex Team	Yes
2024-01-23 00:00	WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting WP Go Maps <= 9.0.28	`CVE-2023-6697`	6.1 Medium	Nex Team	Yes
2024-01-08 00:00	Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images Envira Gallery <= 1.8.7.2	`CVE-2023-6742`	4.3 Medium	Nex Team	Yes
2024-01-08 00:00	ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure ElementsKit Elementor Addons <= 3.0.3	`CVE-2023-6582`	5.3 Medium	Nex Team	Yes
2024-01-05 00:00	Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields Orbit Fox <= 2.10.26	`CVE-2023-6781`	6.4 Medium	Nex Team	Yes
2024-01-03 00:00	PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields Page Builder: Pagelayer <= 1.7.8	`CVE-2023-6738`	5.4 Medium	Nex Team	Yes

Showing 1–10 of 12 reports