Paolo Tresso

Paolo Tresso is a security researcher credited with 12 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #378 of 3,515 contributors. Their disclosures were published between 2023 and 2026. The most productive year was 2026, with 7 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 5 of their findings (42%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization. The average CVSS score across these disclosures is 5.9, peaking at 9.8. Severity breakdown: 1 critical and 1 high.

The most affected software includes Addon Elements for Elementor (formerly… (4), Career Section (1), Frontend Admin by DynamiApps (1), across 9 distinct plugins, themes and core versions in total.

All 12 disclosed issues have since received a vendor fix. The most severe finding, "Career Section <= 1.7 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

2023202420252026

Critical

High

Medium

Low

Global Rank

#378

of 3,515 researchers

Vulns

Critical1

High1

Medium10

Low0

Affected Assets

9plugins

Avg CVSS

5.9

Average score of vulnerabilities

Researcher Submissions

12 records


2026-05-13 18:04	Career Section <= 1.7 - Unauthenticated Arbitrary File Upload Career Section <= 1.7	`CVE-2026-6271`	9.8 Critical	Paolo Tresso	Yes
2026-04-03 22:13	WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode WPFunnels <= 3.7.9	`CVE-2026-0626`	6.4 Medium	Paolo Tresso	Yes
2026-04-03 22:09	Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload Listeo-Core - Directory Plugin… <= 2.0.27	`CVE-2025-14938`	5.3 Medium	Paolo Tresso	Yes
2026-02-13 19:51	Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints Mail Mint <= 1.19.2	`CVE-2026-1258`	4.9 Medium	Paolo Tresso	Yes
2026-01-23 19:25	GZSEO <= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting GZSEO <= 2.0.11	`CVE-2025-14941`	6.4 Medium	Paolo Tresso	Yes
2026-01-08 18:46	Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field' Frontend Admin by DynamiApps <= 3.28.23	`CVE-2025-14937`	7.2 High	Paolo Tresso	Yes
2026-01-08 18:02	WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode WP Google Street View (with 360°… <= 1.1.8	`CVE-2026-0563`	6.4 Medium	Paolo Tresso	Yes
2025-12-17 23:38	Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion Sweet Energy Efficiency <= 1.0.6	`CVE-2025-14618`	4.3 Medium	Paolo Tresso	Yes
2023-11-15 00:00	Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery Addon Elements for Elementor (formerly… <= 1.12.7	`CVE-2023-4689`	5.4 Medium	Marco Wotschka	Yes
2023-11-15 00:00	Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure Addon Elements for Elementor (formerly… <= 1.12.7	`CVE-2023-4723`	5.3 Medium	Marco Wotschka	Yes

Showing 1–10 of 12 reports