normaandersonfrank

normaandersonfrank is a security researcher credited with 14 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #384 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Missing Authorization, which accounts for 8 of their findings (57%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.1, peaking at 6.4.

The most affected software includes Ad Inserter (1), Appointment Booking Plugin (1), Gutenberg Essential Blocks (1), across 14 distinct plugins, themes and core versions in total.

All 14 disclosed issues have since received a vendor fix.

2026

Critical

High

Medium

Low

Global Rank

#384

of 3,823 researchers

Vulns

Critical0

High0

Medium14

Low0

Affected Assets

14plugins

Avg CVSS

5.1

Average score of vulnerabilities

Researcher Submissions

14 records


2026-10-09 15:51	Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site Hello Plus <= 1.7.7	`CVE-2026-5727`	5.4 Medium	normaandersonfrank	Yes
2026-09-10 00:00	Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter Media Library Assistant <= 3.35	`CVE-2026-6640`	6.4 Medium	normaandersonfrank	Yes
2026-08-04 18:35	Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function Xpro Addons <= 1.5.1	`CVE-2026-7105`	4.3 Medium	normaandersonfrank	Yes
2026-07-08 00:00	Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter Smash Balloon Social Photo Feed <= 6.11.1	`CVE-2026-12002`	4.7 Medium	normaandersonfrank	Yes
2026-06-05 14:15	Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode Ad Inserter <= 2.8.15	`CVE-2026-9280`	6.1 Medium	normaandersonfrank	Yes
2026-06-05 12:41	Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes Page-list <= 6.2	`CVE-2026-9008`	4.3 Medium	normaandersonfrank	Yes
2026-05-27 17:42	SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate SMTP2GO for WordPress <= 1.16.0	`CVE-2026-7621`	4.3 Medium	normaandersonfrank	Yes
2026-05-21 19:25	Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter Widget Context <= 1.3.3	`CVE-2026-7615`	4.3 Medium	normaandersonfrank	Yes
2026-05-01 16:12	Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes Gutenberg Essential Blocks <= 6.0.4	`CVE-2026-4658`	6.4 Medium	AlexHenry	Yes
2026-04-16 15:19	LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID Appointment Booking Plugin <= 5.3.2	`CVE-2026-5234`	5.3 Medium	normaandersonfrank	Yes

Showing 1–10 of 14 reports