stealthcopter

stealthcopter is a security researcher credited with 602 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #9 of 3,899 contributors. Their disclosures were published between 2019 and 2026. The most productive year was 2024, with 401 findings.

Their research concentrates on Improper Neutralization Of Input During Web Page Generation, which accounts for 320 of their findings (53%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, Exposure Of Sensitive Information To An Unauthorized Actor. The average CVSS score across these disclosures is 6.9, peaking at 10.0. Severity breakdown: 77 critical and 99 high.

The most affected software includes JetElements (9), JetEngine (8), Royal Addons for Elementor (8), across 461 distinct plugins, themes and core versions in total.

462 of the 602 disclosed issues have a vendor fix, while 140 remain unpatched. The most severe finding, "WP Photo Album Plus <= 8.7.01.001 - Unauthenticated Arbitrary File Upload", scores 10.0 out of 10.

20192020202120222023202420252026

Critical

High

Medium

Low

Global Rank

of 3,899 researchers

Vulns

602

Critical77

High99

Medium426

Low0

Affected Assets

466

380plugins85themes1core version

Avg CVSS

6.9

Average score of vulnerabilities

Researcher Submissions

602 records


2026-10-09 17:01	Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields Graphene <= 2.9.4	`CVE-2026-17025`	6.4 Medium	stealthcopter	Yes
2026-08-27 15:15	LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes LiteSpeed Cache <= 7.7	`CVE-2026-3129`	6.4 Medium	stealthcopter	Yes
2026-08-18 13:17	Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes Speed Optimizer <= 7.8.0	`CVE-2026-15421`	6.4 Medium	stealthcopter	Yes
2026-08-15 16:04	Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field Paid Membership Plugin <= 4.16.19	`CVE-2026-18385`	5.4 Medium	stealthcopter	Yes
2026-06-11 00:00	CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 - Unauthenticated Stored Cross-Site Scripting Anti-Spam, Spam FireWall by CleanTalk < 6.79	`CVE-2026-8071`	7.2 High	stealthcopter	Yes
2026-06-11 00:00	Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting Email Encoder < 2.4.7	`CVE-2026-5776`	7.2 High	stealthcopter	Yes
2026-06-08 13:48	FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text FV Flowplayer Video Player <= 7.5.49.7212	`CVE-2026-7556`	7.2 High	stealthcopter	Yes
2026-06-04 00:00	Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting Email Address Encoder < 1.0.25	`CVE-2026-5305`	7.2 High	stealthcopter	Yes
2026-05-26 20:55	Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG Xpro Elementor Addons - Pro <= 1.4.7	`CVE-2025-0898`	6.5 Medium	stealthcopter	Yes
2026-05-01 00:00	Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic Widget Options - Extended <= 5.3.2	`CVE-2026-2052`	8.8 High	stealthcopter	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 602 records. Every record has its own page and is listed in the sitemap.