Tarcísio Luchesi

Tarcísio Luchesi is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #536 of 3,908 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 2 of their findings (25%). Other recurring categories include Deserialization Of Untrusted Data, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.4, peaking at 8.1. Severity breakdown: 0 critical and 4 high.

The most affected software includes Participants Database (3), Fluent Forms Pro Add On Pack (2), Kirki (1), across 5 distinct plugins, themes and core versions in total.

5 of the 8 disclosed issues have a vendor fix, while 3 remain unpatched. The most severe finding, "Participants Database <= 2.7.8.5 - Unauthenticated PHP Object Injection", scores 8.1 out of 10.