Osvaldo Noe Gonzalez Del Rio (Os)

Osvaldo Noe Gonzalez Del Rio (Os) is a security researcher credited with 73 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #93 of 3,899 contributors. The disclosure was published in 2026.

Their research concentrates on Improper Neutralization Of Input During Web Page Generation, which accounts for 32 of their findings (44%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.8, peaking at 9.8. Severity breakdown: 5 critical and 25 high.

The most affected software includes Divi (6), InfusedWoo Pro (5), Gutenverse (3), across 55 distinct plugins, themes and core versions in total.

72 of the 73 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#93

of 3,899 researchers

Vulns

Critical5

High25

Medium43

Low0

Affected Assets

50plugins5themes

Avg CVSS

6.8

Average score of vulnerabilities

Researcher Submissions

73 records


2026-10-14 16:27	Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter Link Library <= 7.9.2	`CVE-2026-15090`	7.5 High	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-10-02 17:43	WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter WPC Estimated Delivery Date… <= 4.0.1	`CVE-2026-104313`	6.1 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-30 00:00	Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting Advanced Woo Labels <= 2.51	`CVE-2026-12241`	5.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-18 19:07	BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation BlockSpare <= 4.2.6	`CVE-2026-1242`	4.3 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-17 18:29	Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint Divi 5.0 – 5.11.1	`CVE-2026-91707`	5.3 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-07 00:00	EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter EDD Product Catalog Feed… <= 1.0.2	`CVE-2026-9331`	7.1 High	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-04 18:15	Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3853`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-04 18:13	Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter Divi <= 4.27.6	`CVE-2026-4361`	5.0 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-02 19:51	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3852`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-01 17:38	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter Divi <= 4.27.5	`CVE-2026-3850`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes

Showing 1–10 of 73 reports