shark3y

shark3y is a security researcher credited with 44 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #152 of 3,878 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 24 findings.

Their research concentrates on Missing Authorization, which accounts for 16 of their findings (36%). Other recurring categories include Cross-Site Scripting, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.6, peaking at 9.8. Severity breakdown: 4 critical and 16 high.

The most affected software includes weMail (2), 10Web Booster (1), Ajax Load More (1), across 43 distinct plugins, themes and core versions in total.

42 of the 44 disclosed issues have a vendor fix, while 2 remain unpatched. The most severe finding, "Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#152

of 3,878 researchers

Vulns

Critical4

High16

Medium23

Low1

Affected Assets

43plugins

Avg CVSS

6.6

Average score of vulnerabilities

Researcher Submissions

44 records


2026-10-08 19:22	Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension Redux Framework <= 4.5.11	`CVE-2025-14123`	6.8 Medium	shark3y	Yes
2026-09-04 00:00	Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes Events Manager <= 7.3.3	`CVE-2025-14945`	5.4 Medium	shark3y	Yes
2026-05-04 13:32	Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter Loco Translate <= 2.8.2	`CVE-2026-1921`	4.9 Medium	shark3y	Yes
2026-04-17 04:24	WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file WP Customer Area <= 8.3.4	`CVE-2026-3464`	8.8 High	shark3y	Yes
2026-03-25 17:26	Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template Elementor Website Builder <= 3.35.7	`CVE-2026-1206`	4.3 Medium	shark3y	Yes
2026-03-23 16:27	WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users WP DSGVO Tools (GDPR) <= 3.1.38	`CVE-2026-4283`	9.1 Critical	shark3y	Yes
2026-03-04 00:00	Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level' Membership Plugin <= 3.2.20	`CVE-2026-1321`	8.1 High	shark3y	Yes
2026-02-20 20:58	weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion weMail <= 2.0.7	`CVE-2025-14339`	6.5 Medium	shark3y	Yes
2026-02-18 16:16	Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update Shield Security <= 21.0.9	`CVE-2025-14427`	4.3 Medium	shark3y	Yes
2026-02-16 16:35	Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update افزونه پرداخت امن زرین‌پال برای… <= 5.0.16	`CVE-2026-2592`	7.7 High	shark3y	Yes

Showing 1–10 of 44 reports