Osman Hussein

Osman Hussein is a security researcher credited with 11 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #445 of 3,917 contributors. The disclosure was published in 2026.

Their research concentrates on Unrestricted Upload Of File With Dangerous Type, which accounts for 8 of their findings (73%). Other recurring categories include Deserialization Of Untrusted Data, Missing Authentication For Critical Functionality. The average CVSS score across these disclosures is 9.0, peaking at 9.8. Severity breakdown: 8 critical and 2 high.

The most affected software includes 10Web Booster (1), 3D Product configurator for WooCommerce (1), ELEX WordPress HelpDesk & Customer… (1), across 11 distinct plugins, themes and core versions in total.

All 11 disclosed issues have since received a vendor fix. The most severe finding, "Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#445

of 3,917 researchers

Vulns

Critical8

High2

Medium1

Low0

Affected Assets

11plugins

Avg CVSS

9.0

Average score of vulnerabilities

Researcher Submissions

11 records


2026-10-30 19:25	Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection Project Manager <= 4.1.1	`CVE-2026-116512`	9.8 Critical	Osman Hussein	Yes
2026-10-30 17:33	PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field PDF Invoice for WooCommerce + Drag… <= 7.1.1	`CVE-2026-109220`	9.8 Critical	Osman Hussein	Yes
2026-10-26 00:00	Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect Welcart e-Commerce < 2.12.6	`CVE-2026-111031`	4.7 Medium	Osman Hussein	Yes
2026-10-15 17:03	ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment ELEX WordPress HelpDesk & Customer… <= 3.3.7	`CVE-2026-103768`	9.8 Critical	Osman Hussein	Yes
2026-10-15 16:07	Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter Mang Board 2.4.4	`CVE-2026-109219`	9.8 Critical	Osman Hussein	Yes
2026-10-14 15:49	10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter 10Web Booster <= 2.34.10	`CVE-2026-108587`	9.8 Critical	Osman Hussein	Yes
2026-10-14 04:54	FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter FV Flowplayer Video Player <= 7.5.54.7212	`CVE-2026-86461`	8.8 High	Osman Hussein	Yes
2026-10-13 13:14	Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url Printcart Store <= 2.9.1	`CVE-2026-93388`	9.8 Critical	Osman Hussein	Yes
2026-10-09 15:36	3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter 3D Product configurator for WooCommerce <= 2.16.2	`CVE-2026-103889`	9.8 Critical	Osman Hussein	Yes
2026-10-09 15:24	Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload Extensions For CF7 (Contact form 7… <= 3.4.5	`CVE-2026-94589`	9.8 Critical	Osman Hussein	Yes

Showing 1–10 of 11 reports