PPzzAArr

PPzzAArr is a security researcher credited with 20 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #258 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 17 findings.

Their research concentrates on Missing Authorization, which accounts for 11 of their findings (55%). Other recurring categories include Cross-Site Scripting, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 5.1, peaking at 7.5. Severity breakdown: 0 critical and 1 high.

The most affected software includes Advanced Coupons for WooCommerce (1), Booking and Rental Manager for Bike (1), Car Rental Manager (1), across 20 distinct plugins, themes and core versions in total.

18 of the 20 disclosed issues have a vendor fix, while 2 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#258

of 3,515 researchers

Vulns

Critical0

High1

Medium18

Low1

Affected Assets

20plugins

Avg CVSS

5.1

Average score of vulnerabilities

Researcher Submissions

20 records


2026-08-18 00:00	Issues and Series for Newspapers, Magazines, Publishers, Writers <= 2.17.0 - Authenticated (Administrator+) Stored Cross-Site Scripting Issues and Series for Newspapers <= 2.17.0	`CVE-2026-27365`	4.4 Medium	PPzzAArr	Yes
2026-05-07 00:00	YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference YITH WooCommerce Wishlist <= 4.12.0	`CVE-2026-27329`	5.3 Medium	PPzzAArr	Yes
2026-03-23 00:00	Booking and Rental Manager for Bike \| Car \| Resort \| Appointment \| Dress \| Equipment <= 2.6.0 - Missing Authorization Booking and Rental Manager for Bike <= 2.6.0	`CVE-2026-23972`	4.3 Medium	PPzzAArr	Yes
2026-03-17 00:00	CP Multi View Events Calendar <= 1.4.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting CP Multi View Events Calendar <= 1.4.39	`CVE-2026-25465`	6.4 Medium	PPzzAArr	Yes
2026-03-16 00:00	StoreCustomizer – A plugin to Customize all WooCommerce Pages <= 2.6.3 - Missing Authorization StoreCustomizer <= 2.6.3	`CVE-2026-27046`	4.3 Medium	PPzzAArr	Yes
2026-03-13 00:00	Subscriptions for WooCommerce <= 1.8.10 - Missing Authorization Subscriptions for WooCommerce <= 1.8.10	`CVE-2026-24372`	5.3 Medium	PPzzAArr	Yes
2026-03-03 00:00	Podlove Web Player <= 5.9.1 - Authenticated (Contributor+) PHP Object Injection Podlove Web Player <= 5.9.1	`CVE-2026-24385`	7.5 High	PPzzAArr	Yes
2026-02-25 00:00	Theater for WordPress <= 0.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting Theater for WordPress <= 0.19	`CVE-2025-69343`	6.4 Medium	PPzzAArr	Yes
2026-02-25 00:00	Scientific and Interactive Blocks – inseri core <= 1.0.5 - Missing Authorization Scientific and Interactive Blocks <= 1.0.5	`CVE-2026-27344`	5.3 Medium	PPzzAArr	No
2026-02-06 00:00	Advanced Coupons for WooCommerce Coupons <= 4.7.1 - Missing Authorization Advanced Coupons for WooCommerce <= 4.7.1	`CVE-2026-31919`	4.3 Medium	PPzzAArr	Yes

Showing 1–10 of 20 reports