Quốc Huy (jtwings)

Quốc Huy (jtwings) is a security researcher credited with 20 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #286 of 3,878 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 6 of their findings (30%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.0, peaking at 8.8. Severity breakdown: 0 critical and 4 high.

The most affected software includes Blocksy (2), Advanced Contact form 7 DB (1), Database for Contact Form 7 (1), across 19 distinct plugins, themes and core versions in total.

All 20 disclosed issues have since received a vendor fix. The most severe finding, "Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field", scores 8.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#286

of 3,878 researchers

Vulns

Critical0

High4

Medium16

Low0

Affected Assets

18plugins1theme

Avg CVSS

6.0

Average score of vulnerabilities

Researcher Submissions

20 records


2026-09-22 17:36	Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode Advanced Contact form 7 DB <= 2.1.1	`CVE-2026-6831`	6.5 Medium	Quốc Huy (jtwings)	Yes
2026-09-21 18:57	WP Table Builder 2.1.1 - 2.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter WP Table Builder 2.1.1 – 2.1.13	`CVE-2026-6922`	7.1 High	Quốc Huy (jtwings)	Yes
2026-08-21 00:00	Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication Post Duplicator <= 3.0.11	`CVE-2026-4245`	4.3 Medium	Quốc Huy (jtwings)	Yes
2026-07-23 18:30	Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Open User Map <= 1.4.45	`CVE-2026-15755`	6.4 Medium	Quốc Huy (jtwings)	Yes
2026-07-23 14:27	Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute Firelight Lightbox <= 2.3.20	`CVE-2026-6454`	6.4 Medium	Quốc Huy (jtwings)	Yes
2026-06-08 20:11	Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field Blocksy <= 2.1.41	`CVE-2026-8365`	8.8 High	Quốc Huy (jtwings)	Yes
2026-05-27 10:58	Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending Everest Forms <= 3.4.7	`CVE-2026-4888`	4.3 Medium	Quốc Huy (jtwings)	Yes
2026-04-10 11:56	Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter Optimole <= 4.2.2	`CVE-2026-5217`	7.2 High	Quốc Huy (jtwings)	Yes
2026-03-31 12:23	Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode Database for Contact Form 7 <= 1.4.9	`CVE-2026-3831`	4.3 Medium	Quốc Huy (jtwings)	Yes
2026-03-18 00:00	Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter Download Manager <= 3.3.49	`CVE-2026-2571`	4.3 Medium	Quốc Huy (jtwings)	Yes

Showing 1–10 of 20 reports