Peter Tang

Peter Tang is a security researcher credited with 25 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #241 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Missing Authorization, which accounts for 11 of their findings (44%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, SQL Injection. The average CVSS score across these disclosures is 5.8, peaking at 8.8. Severity breakdown: 0 critical and 4 high.

The most affected software includes Creator LMS (2), Eventin (2), Majestic Support (2), across 22 distinct plugins, themes and core versions in total.

All 25 disclosed issues have since received a vendor fix. The most severe finding, "Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Authenticated (Contributor+) Arbitrary File Upload", scores 8.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#241

of 3,823 researchers

Vulns

Critical0

High4

Medium21

Low0

Affected Assets

22plugins

Avg CVSS

5.8

Average score of vulnerabilities

Researcher Submissions

25 records


2026-10-14 00:00	CP Multi View Events Calendar <= 1.4.41 - Authenticated (Contributor+) SQL Injection CP Multi View Events Calendar <= 1.4.41	`CVE-2026-109901`	6.5 Medium	Peter Tang	Yes
2026-10-12 17:09	Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.6 - Missing Authorization Broadcast Live Video <= 7.3.6	`CVE-2026-108475`	4.3 Medium	Peter Tang	Yes
2026-10-12 00:00	Bus Ticket Booking with Seat Reservation <= 5.9.7 - Missing Authorization Bus Ticket Booking with Seat Reservation <= 5.9.7	`CVE-2026-107425`	5.3 Medium	Peter Tang	Yes
2026-10-12 00:00	Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.12 - Missing Authorization Paid Videochat Turnkey Site <= 7.5.12	`CVE-2026-107426`	5.3 Medium	Peter Tang	Yes
2026-10-12 00:00	WP w3all phpBB <= 3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting WP w3all phpBB <= 3.1.0	`CVE-2026-107422`	6.4 Medium	Peter Tang	Yes
2026-10-12 00:00	Push Notification for Post and BuddyPress <= 3.23 - Missing Authorization Push Notification for Post… <= 3.23	`CVE-2026-107417`	5.3 Medium	Peter Tang	Yes
2026-10-12 00:00	Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.22 - Missing Authorization Flexible Quantity <= 2.3.22	`CVE-2026-106605`	5.3 Medium	Peter Tang	Yes
2026-10-08 17:29	Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Authenticated (Contributor+) Arbitrary File Upload Creator LMS <= 1.2.21	`CVE-2026-62129`	8.8 High	Peter Tang	Yes
2026-10-08 00:00	Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 - Authenticated (Custom Role+) SQL Injection Vitepos <= 3.6.1	`CVE-2026-105076`	6.5 Medium	Peter Tang	Yes
2026-10-08 00:00	Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Missing Authorization Creator LMS <= 1.2.21	`CVE-2026-62128`	5.3 Medium	Peter Tang	Yes

Showing 1–10 of 25 reports