Osvaldo Noe Gonzalez Del Rio (Os)

Osvaldo Noe Gonzalez Del Rio (Os) is a security researcher credited with 68 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #94 of 3,515 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 30 of their findings (44%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.9, peaking at 9.8. Severity breakdown: 5 critical and 24 high.

The most affected software includes Divi (5), InfusedWoo Pro (5), Gutenverse (3), across 52 distinct plugins, themes and core versions in total.

67 of the 68 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#94

of 3,515 researchers

Vulns

Critical5

High24

Medium39

Low0

Affected Assets

47plugins5themes

Avg CVSS

6.9

Average score of vulnerabilities

Researcher Submissions

68 records


2026-09-07 00:00	EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter EDD Product Catalog Feed… <= 1.0.2	`CVE-2026-9331`	7.1 High	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-04 18:15	Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3853`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-04 18:13	Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter Divi <= 4.27.6	`CVE-2026-4361`	5.0 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-02 19:51	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3852`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-01 17:38	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter Divi <= 4.27.5	`CVE-2026-3850`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-01 14:46	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode Divi <= 4.27.6	`CVE-2026-3851`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-08-31 15:53	Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute Live Composer <= 2.1.19	`CVE-2026-13203`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-08-27 14:09	Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter Optimole <= 4.2.10	`CVE-2026-77365`	7.2 High	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-08-25 00:00	Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks Gutenverse <= 4.0.2	`CVE-2026-3002`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-08-24 15:00	InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure InfusedWoo Pro <= 5.1.17	`CVE-2026-19892`	8.8 High	Osvaldo Noe Gonzalez Del Rio (Os)	Yes

Showing 1–10 of 68 reports