Sopon Tangpathum (SoNaJaa)

Sopon Tangpathum (SoNaJaa) is a security researcher credited with 13 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #364 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 8 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 4 of their findings (31%). Other recurring categories include Missing Authorization, Server-Side Request Forgery (SSRF). The average CVSS score across these disclosures is 6.0, peaking at 7.5. Severity breakdown: 0 critical and 4 high.

The most affected software includes All In One Image Viewer (1), Bookme (1), Contact Form vCard Generator (1), across 13 distinct plugins, themes and core versions in total.

10 of the 13 disclosed issues have a vendor fix, while 3 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#364

of 3,515 researchers

Vulns

Critical0

High4

Medium9

Low0

Affected Assets

13plugins

Avg CVSS

6.0

Average score of vulnerabilities

Researcher Submissions

13 records


2026-02-18 16:21	WP Customer Reviews <= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter WP Customer Reviews <= 3.7.5	`CVE-2025-14452`	7.2 High	Athiwat Tiprasaharn (Jitlada)	Yes
2026-02-04 20:41	All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint All In One Image Viewer <= 1.0.2	`CVE-2026-1294`	7.2 High	Athiwat Tiprasaharn (Jitlada)	Yes
2026-01-27 17:21	TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter TableMaster for Elementor <= 1.3.6	`CVE-2025-14610`	7.2 High	Athiwat Tiprasaharn (Jitlada)	Yes
2026-01-13 16:43	SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title SearchWiz <= 1.0.0	`CVE-2026-0694`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	No
2026-01-08 21:36	Contact Form vCard Generator <= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter Contact Form vCard Generator <= 2.4	`CVE-2025-13717`	5.3 Medium	Sopon Tangpathum (SoNaJaa)	No
2026-01-06 20:08	Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter Stylish Order Form Builder <= 1.0	`CVE-2025-13531`	6.4 Medium	Sopon Tangpathum (SoNaJaa)	Yes
2026-01-06 19:39	Recras WordPress plugin <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'recrasname' Shortcode Attribute Recras <= 6.4.1	`CVE-2025-13497`	6.4 Medium	Sopon Tangpathum (SoNaJaa)	Yes
2026-01-06 18:33	HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args HelpDesk.com Contact Form <= 1.1.5	`CVE-2025-13657`	4.3 Medium	Sopon Tangpathum (SoNaJaa)	Yes
2025-12-15 02:22	Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification Modula Image Gallery <= 2.13.3	`CVE-2025-14003`	4.3 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2025-12-12 16:04	Eyewear prescription form <= 7.0.2 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation Eyewear prescription form <= 7.0.2	`CVE-2025-14366`	5.3 Medium	Athiwat Tiprasaharn (Jitlada)	Yes

Showing 1–10 of 13 reports