Supakiad S. (m3ez)

Supakiad S. (m3ez) is a security researcher credited with 82 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #84 of 3,917 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 80 findings.

Their research concentrates on Missing Authorization, which accounts for 28 of their findings (34%). Other recurring categories include Improper Neutralization Of Input During Web Page Generation, Improper Neutralization Of Special Elements Used In An SQL Command. The average CVSS score across these disclosures is 6.9, peaking at 9.8. Severity breakdown: 9 critical and 40 high.

The most affected software includes Tutor LMS (10), SlimStat Analytics (5), Advanced Ads – Ad Manager & AdSense (2), across 58 distinct plugins, themes and core versions in total.

77 of the 82 disclosed issues have a vendor fix, while 5 remain unpatched. The most severe finding, "JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#84

of 3,917 researchers

Vulns

Critical9

High40

Medium33

Low0

Affected Assets

58plugins

Avg CVSS

6.9

Average score of vulnerabilities

Researcher Submissions

82 records


2026-10-29 18:46	Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter Formidable Forms <= 6.35	`CVE-2026-89435`	8.8 High	Supakiad S. (m3ez)	Yes
2026-10-29 18:25	Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field Gravity Forms <= 3.1.2	`CVE-2026-97645`	7.2 High	Supakiad S. (m3ez)	Yes
2026-10-28 14:45	Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie Food Store <= 1.5.5	`CVE-2026-96669`	7.2 High	Supakiad S. (m3ez)	No
2026-10-15 17:57	CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter CP Multi View Events Calendar <= 1.4.42	`CVE-2026-110701`	7.2 High	Supakiad S. (m3ez)	Yes
2026-10-15 16:37	User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] User Profile Builder <= 4.0.3	`CVE-2026-109447`	8.1 High	Supakiad S. (m3ez)	Yes
2026-10-15 16:30	PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter PilotPress <= 2.0.43	`CVE-2026-85659`	8.8 High	Supakiad S. (m3ez)	Yes
2026-10-15 15:47	Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping Groundhogg <= 4.9.3	`CVE-2026-109221`	8.1 High	Supakiad S. (m3ez)	Yes
2026-10-15 15:29	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id} Dokan: AI Powered WooCommerce… <= 5.2.1	`CVE-2026-89280`	4.3 Medium	Supakiad S. (m3ez)	Yes
2026-10-13 15:34	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection JTL-Connector for WooCommerce <= 2.4.3	`CVE-2026-78193`	7.5 High	Supakiad S. (m3ez)	No
2026-10-13 15:18	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method JTL-Connector for WooCommerce <= 2.4.3	`CVE-2026-87855`	9.8 Critical	Supakiad S. (m3ez)	No

Showing 1–10 of 82 reports