siavashvafshar

siavashvafshar is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #531 of 3,515 contributors. The disclosure was published in 2025.

Their research concentrates on Cross-Site Scripting, which accounts for 6 of their findings (75%). Other recurring categories include Improper Neutralization Of Script-Related HTML Tags In A Web Page (Basic XSS), Unrestricted Upload Of File With Dangerous Type. The average CVSS score across these disclosures is 6.4, peaking at 8.8. Severity breakdown: 0 critical and 1 high.

The most affected software includes Download Manager (1), Event Booking Manager for WooCommerce (1), Link Library (1), across 8 distinct plugins, themes and core versions in total.

6 of the 8 disclosed issues have a vendor fix, while 2 remain unpatched. The most severe finding, "Pixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload", scores 8.8 out of 10.

2025

Critical

High

Medium

Low

Global Rank

#531

of 3,515 researchers

Vulns

Critical0

High1

Medium7

Low0

Affected Assets

8plugins

Avg CVSS

6.4

Average score of vulnerabilities

Researcher Submissions

8 records


2025-06-17 14:04	Pixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload Pixabay Images <= 3.4	`CVE-2025-4413`	8.8 High	siavashvafshar	No
2025-06-06 21:50	WpEvently <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Event Booking Manager for WooCommerce <= 4.4.2	`CVE-2025-5568`	6.4 Medium	siavashvafshar	Yes
2025-05-16 00:00	WP Notes Widget <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Notes Widget <= 1.0.6	`CVE-2025-48121`	6.4 Medium	siavashvafshar	No
2025-04-30 18:14	Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Team Members Showcase <= 3.4.1	`CVE-2025-3521`	6.4 Medium	siavashvafshar	Yes
2025-04-17 19:29	Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Download Manager <= 3.3.12	`CVE-2025-3056`	5.4 Medium	siavashvafshar	Yes
2025-04-08 15:42	WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload Project Manager <= 2.6.22	`CVE-2025-3100`	6.4 Medium	siavashvafshar	Yes
2025-04-07 00:00	Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting Motors <= 1.4.63	`CVE-2025-2808`	5.4 Medium	siavashvafshar	Yes
2025-04-04 11:06	Link Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters Link Library <= 7.7.3	`CVE-2025-2889`	6.4 Medium	siavashvafshar	Yes

Showing 1–8 of 8 reports