Nguyen Truong (Roll)

Nguyen Truong (Roll) is a security researcher credited with 9 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #539 of 3,899 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 7 findings.

Their research concentrates on Code Injection, which accounts for 3 of their findings (33%). Other recurring categories include SQL Injection, Cross-Site Scripting. The average CVSS score across these disclosures is 6.5, peaking at 7.2. Severity breakdown: 0 critical and 5 high.

The most affected software includes Advanced Shipment Tracking… (1), CTX Feed Pro (1), Lucky Wheel for WooCommerce (1), across 9 distinct plugins, themes and core versions in total.

7 of the 9 disclosed issues have a vendor fix, while 2 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#539

of 3,899 researchers

Vulns

Critical0

High5

Medium4

Low0

Affected Assets

8plugins1theme

Avg CVSS

6.5

Average score of vulnerabilities

Researcher Submissions

9 records


2026-10-01 15:53	CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution CTX Feed Pro <= 7.6.12	`CVE-2026-10026`	7.2 High	Nguyen Truong (Roll)	No
2026-09-04 00:00	Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters Ninja Forms - Scheduled Exports <= 3.0.3	`CVE-2026-87870`	6.4 Medium	Nguyen Truong (Roll)	Yes
2026-07-28 21:25	Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter Advanced Shipment Tracking… <= 3.9	`N/A`	7.2 High	Nguyen Truong (Roll)	Yes
2026-05-13 14:22	Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter Unlimited Elements for Elementor <= 2.0.7	`CVE-2026-5486`	6.5 Medium	Nguyen Truong (Roll)	Yes
2026-05-01 16:42	Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter Ona <= 1.26	`CVE-2026-6812`	4.4 Medium	Nguyen Truong (Roll)	Yes
2026-02-10 11:56	Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter Lucky Wheel Giveaway <= 1.0.22	`CVE-2025-14541`	7.2 High	Nguyen Truong (Roll)	Yes
2026-01-13 16:50	Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter Shipping Rates by City for WooCommerce <= 1.0.3	`CVE-2026-0678`	4.9 Medium	Nguyen Truong (Roll)	No
2025-12-29 23:11	Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags Lucky Wheel for WooCommerce <= 1.1.13	`CVE-2025-14509`	7.2 High	Nguyen Truong (Roll)	Yes
2025-09-09 00:00	Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload WP All Import <= 3.9.3	`CVE-2025-10001`	7.2 High	Nguyen Truong (Roll)	Yes

Showing 1–9 of 9 reports