Nguyen Truong (Roll)

Nguyen Truong (Roll) is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #536 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 6 findings.

Their research concentrates on SQL Injection, which accounts for 3 of their findings (38%). Other recurring categories include Code Injection, Cross-Site Scripting. The average CVSS score across these disclosures is 6.4, peaking at 7.2. Severity breakdown: 0 critical and 4 high.

The most affected software includes Advanced Shipment Tracking… (1), Lucky Wheel for WooCommerce (1), Lucky Wheel Giveaway (1), across 8 distinct plugins, themes and core versions in total.

7 of the 8 disclosed issues have a vendor fix, while 1 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#536

of 3,515 researchers

Vulns

Critical0

High4

Medium4

Low0

Affected Assets

7plugins1theme

Avg CVSS

6.4

Average score of vulnerabilities

Researcher Submissions

8 records


2026-09-04 00:00	Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters Ninja Forms - Scheduled Exports <= 3.0.3	`CVE-2026-87870`	6.4 Medium	Nguyen Truong (Roll)	Yes
2026-07-28 21:25	Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter Advanced Shipment Tracking… <= 3.9	`N/A`	7.2 High	Nguyen Truong (Roll)	Yes
2026-05-13 14:22	Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter Unlimited Elements For Elementor <= 2.0.7	`CVE-2026-5486`	6.5 Medium	Nguyen Truong (Roll)	Yes
2026-05-01 16:42	Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter Ona <= 1.26	`CVE-2026-6812`	4.4 Medium	Nguyen Truong (Roll)	Yes
2026-02-10 11:56	Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter Lucky Wheel Giveaway <= 1.0.22	`CVE-2025-14541`	7.2 High	Nguyen Truong (Roll)	Yes
2026-01-13 16:50	Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter Shipping Rates by City for WooCommerce <= 1.0.3	`CVE-2026-0678`	4.9 Medium	Nguyen Truong (Roll)	No
2025-12-29 23:11	Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags Lucky Wheel for WooCommerce <= 1.1.13	`CVE-2025-14509`	7.2 High	Nguyen Truong (Roll)	Yes
2025-09-09 00:00	Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload WP All Import <= 3.9.3	`CVE-2025-10001`	7.2 High	Nguyen Truong (Roll)	Yes

Showing 1–8 of 8 reports