Poli

Poli is a security researcher credited with 13 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #369 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 7 findings.

Their research concentrates on Missing Authorization, which accounts for 10 of their findings (77%). Other recurring categories include Exposure Of Sensitive Information Through Data Queries, Server-Side Request Forgery (SSRF). The average CVSS score across these disclosures is 5.3, peaking at 6.5.

The most affected software includes e-shot (2), MORKVA Vchasno Kasa Integration (2), Block Editor Gallery Slider… (1), across 11 distinct plugins, themes and core versions in total.

5 of the 13 disclosed issues have a vendor fix, while 8 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#369

of 3,515 researchers

Vulns

Critical0

High0

Medium13

Low0

Affected Assets

11plugins

Avg CVSS

5.3

Average score of vulnerabilities

Researcher Submissions

13 records


2026-04-14 19:45	Katalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action Katalogportal-pdf-sync Widget <= 1.0.0	`CVE-2026-3649`	5.3 Medium	Poli	No
2026-04-14 19:45	e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX e-shot <= 1.0.2	`CVE-2026-3642`	5.3 Medium	Poli	No
2026-04-07 15:25	LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update LTL Freight Quotes <= 3.3.13	`CVE-2026-3646`	5.3 Medium	Poli	Yes
2026-03-20 15:09	e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action e-shot <= 1.0.2	`CVE-2026-3546`	5.3 Medium	Poli	No
2026-03-20 15:09	Punnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action Punnel <= 1.3.1	`CVE-2026-3645`	5.3 Medium	Poli	No
2026-03-20 15:09	Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter Smarter Analytics <= 2.0	`CVE-2026-3570`	5.3 Medium	Poli	No
2026-03-19 19:51	RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions RockPress <= 1.0.17	`CVE-2026-3550`	5.3 Medium	Poli	Yes
2025-07-28 20:26	Bonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success Bonanza <= 1.0.0	`CVE-2025-6730`	4.3 Medium	Poli	No
2025-07-18 17:11	Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing MORKVA Vchasno Kasa Integration <= 1.0.3	`CVE-2025-6720`	5.3 Medium	Poli	Yes
2025-07-18 00:00	Vchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation MORKVA Vchasno Kasa Integration <= 1.0.3	`CVE-2025-6721`	5.3 Medium	Poli	Yes

Showing 1–10 of 13 reports