Thanh Nam Tran

Thanh Nam Tran is a security researcher credited with 32 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #177 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2024, with 23 findings.

Their research concentrates on Missing Authorization, which accounts for 10 of their findings (31%). Other recurring categories include Cross-Site Scripting, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 7.2, peaking at 9.9. Severity breakdown: 3 critical and 13 high.

The most affected software includes Tutor LMS (3), Happy Addons for Elementor (2), BA Book Everything (1), across 29 distinct plugins, themes and core versions in total.

29 of the 32 disclosed issues have a vendor fix, while 3 remain unpatched. The most severe finding, "BA Book Everything <= 1.6.4 - Authenticated (Contributor+) SQL Injection", scores 9.9 out of 10.

20242025

Critical

High

Medium

Low

Global Rank

#177

of 3,515 researchers

Vulns

Critical3

High13

Medium16

Low0

Affected Assets

29plugins

Avg CVSS

7.2

Average score of vulnerabilities

Researcher Submissions

32 records


2025-07-22 14:03	Social Streams <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation Social Streams <= 1.0.1	`CVE-2025-7722`	8.8 High	Thanh Nam Tran	No
2025-03-21 14:06	Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation Motors <= 1.4.57	`CVE-2024-13737`	4.3 Medium	Thanh Nam Tran	Yes
2025-03-14 14:23	WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all WC Affiliate <= 2.5.3	`CVE-2024-12336`	6.5 Medium	Thanh Nam Tran	Yes
2025-02-28 00:00	SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFile SurveyJS <= 1.12.17	`CVE-2024-12544`	8.8 High	Thanh Nam Tran	Yes
2025-01-31 00:00	ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation ELEX WordPress HelpDesk & Customer… <= 3.2.6	`CVE-2024-12171`	8.8 High	Thanh Nam Tran	Yes
2025-01-16 20:12	WP Hotel Booking <= 2.1.5 - Missing Authorization WP Hotel Booking <= 2.1.5	`CVE-2024-12370`	5.3 Medium	Thanh Nam Tran	Yes
2025-01-09 22:18	Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion Essential WP Real Estate <= 1.1.3	`CVE-2024-13318`	5.3 Medium	Thanh Nam Tran	No
2025-01-07 00:00	MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection MDTF <= 1.3.3.5	`CVE-2024-12030`	6.5 Medium	Thanh Nam Tran	Yes
2025-01-06 16:21	School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation School Management System <= 1.0.8	`CVE-2024-12470`	9.8 Critical	Thanh Nam Tran	No
2024-12-20 20:57	WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db WP BASE Booking of Appointments <= 4.9.2	`CVE-2024-12558`	6.5 Medium	Thanh Nam Tran	Yes

Showing 1–10 of 32 reports