Peter Thaleikis

Peter Thaleikis is a security researcher credited with 536 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #12 of 3,515 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2025, with 358 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 414 of their findings (77%). Other recurring categories include Missing Authorization, SQL Injection. The average CVSS score across these disclosures is 6.3, peaking at 9.9. Severity breakdown: 4 critical and 25 high.

The most affected software includes Arconix Shortcodes (5), Event Post (4), affiliate-toolkit (3), across 478 distinct plugins, themes and core versions in total.

392 of the 536 disclosed issues have a vendor fix, while 144 remain unpatched. The most severe finding, "Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection", scores 9.9 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

#12

of 3,515 researchers

Vulns

536

Critical4

High25

Medium507

Low0

Affected Assets

483

467plugins16themes

Avg CVSS

6.3

Average score of vulnerabilities

Researcher Submissions

536 records


2026-09-01 19:14	Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function Easy Waveform Player <= 1.2.2	`CVE-2025-7963`	6.4 Medium	Peter Thaleikis	Yes
2026-08-18 00:00	Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection Youzify <= 1.3.7	`CVE-2026-73397`	8.1 High	Peter Thaleikis	No
2026-07-10 00:00	Document Gallery <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting Document Gallery <= 5.1.0	`CVE-2026-57695`	7.2 High	Peter Thaleikis	Yes
2026-05-27 00:00	Master Slider – Responsive Touch Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Master Slider <= 3.10.8	`CVE-2026-48968`	6.4 Medium	Peter Thaleikis	Yes
2026-05-07 00:00	Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting Royal Addons for Elementor < 1.7.1053	`CVE-2026-27421`	6.4 Medium	Peter Thaleikis	Yes
2026-03-06 16:42	Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation Paid Videochat Turnkey Site <= 7.3.20	`CVE-2025-8899`	8.8 High	Peter Thaleikis	Yes
2026-02-18 15:22	Renden <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title Renden <= 1.8.1	`CVE-2025-12117`	6.4 Medium	Peter Thaleikis	No
2026-02-18 15:05	Drift <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title Drift <= 1.5.0	`CVE-2025-12116`	6.4 Medium	Peter Thaleikis	No
2026-01-27 17:12	Target Video Easy Publish <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameter Target Video Easy Publish <= 3.8.8	`CVE-2025-8072`	6.4 Medium	Peter Thaleikis	Yes
2026-01-13 16:49	SpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode SpiceForms Form Builder <= 1.0	`CVE-2025-12178`	6.4 Medium	Peter Thaleikis	No

Showing 1–10 of 250 reports

Showing the 250 most recent of 536 records. Every record has its own page and is listed in the sitemap.