thevietronin

thevietronin is a security researcher credited with 31 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #204 of 3,878 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2026, with 19 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 9 of their findings (29%). Other recurring categories include SQL Injection, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.7, peaking at 9.8. Severity breakdown: 5 critical and 11 high.

The most affected software includes WP Job Portal (12), ACF Frontend Admin by DynamiApps (1), Branda (1), across 20 distinct plugins, themes and core versions in total.

30 of the 31 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier", scores 9.8 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

#204

of 3,878 researchers

Vulns

Critical5

High11

Medium15

Low0

Affected Assets

20plugins

Avg CVSS

6.7

Average score of vulnerabilities

Researcher Submissions

31 records


2026-10-15 15:51	InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting InstaWP Connect <= 0.1.4.1	`CVE-2026-109400`	7.5 High	thevietronin	Yes
2026-10-14 16:34	Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' Premium Packages <= 7.0.5	`CVE-2026-18586`	7.2 High	thevietronin	Yes
2026-10-14 16:32	Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter Groundhogg <= 4.5.14	`CVE-2026-18548`	7.2 High	thevietronin	Yes
2026-10-13 15:36	Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter Smart Forms <= 2.6.104	`CVE-2026-95816`	7.2 High	thevietronin	No
2026-10-02 13:35	Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter Ultimate Member <= 2.13.1	`CVE-2026-96270`	7.2 High	thevietronin	Yes
2026-09-24 19:02	Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter Themify Builder <= 7.8.1	`CVE-2026-95864`	7.2 High	thevietronin	Yes
2026-09-15 15:28	WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request WP-Lister Lite for eBay <= 3.8.9	`CVE-2026-18595`	7.2 High	thevietronin	Yes
2026-09-11 18:53	MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path MPG <= 4.2.1	`CVE-2026-85198`	6.5 Medium	Nhien Pham (nhienit) (nhienit)	Yes
2026-09-05 13:59	Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier ACF Frontend Admin by DynamiApps <= 3.29.12	`CVE-2026-75816`	9.8 Critical	thevietronin	Yes
2026-08-15 04:54	Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router Pods 2.8 – 3.3.9 · 6 branches	`CVE-2026-19598`	9.8 Critical	Nhien Pham (nhienit) (nhienit)	Yes

Showing 1–10 of 31 reports