Pedro Cuco (Illex)

Pedro Cuco (Illex) is a security researcher credited with 5 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #816 of 3,515 contributors. Their disclosures were published between 2023 and 2025. The most productive year was 2025, with 2 findings.

Their research concentrates on Authorization Bypass Through User-Controlled Key, which accounts for 2 of their findings (40%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting. The average CVSS score across these disclosures is 4.3, peaking at 4.4.

The most affected software includes ERP (2), WP Dashboard Notes (2), Site Notes (1), across 3 distinct plugins, themes and core versions in total.

4 of the 5 disclosed issues have a vendor fix, while 1 remain unpatched.

202320242025

Critical

High

Medium

Low

Global Rank

#816

of 3,515 researchers

Vulns

Critical0

High0

Medium5

Low0

Affected Assets

3plugins

Avg CVSS

4.3

Average score of vulnerabilities

Researcher Submissions

5 records


2025-03-03 00:00	WP ERP <= 1.13.3 - Authenticated (Admin+) Stored Cross-Site Scripting ERP <= 1.13.3	`CVE-2024-12808`	4.4 Medium	Pedro Cuco (Illex)	Yes
2025-03-03 00:00	WP ERP <= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference ERP <= 1.13.3	`CVE-2024-12812`	4.3 Medium	Pedro Cuco (Illex)	Yes
2024-01-26 00:00	WP Dashboard Notes <= 1.0.10 - Missing Authorization to Arbitrary Private Notes Update WP Dashboard Notes <= 1.0.10	`CVE-2023-7239`	4.3 Medium	Pedro Cuco (Illex)	Yes
2024-01-03 00:00	Site Notes <= 2.0.0 - Cross-Site Request Forgery to Admin Note Deletion Site Notes <= 2.0.0	`CVE-2023-6633`	4.3 Medium	Pedro Cuco (Illex)	No
2023-12-19 00:00	WP Dashboard Notes <= 1.0.10 - Insecure Direct Object References to Authenticated Private Note Deletion WP Dashboard Notes <= 1.0.10	`CVE-2023-7198`	4.3 Medium	Pedro Cuco (Illex)	Yes

Showing 1–5 of 5 reports