tmrswrr

tmrswrr is a security researcher credited with 12 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #377 of 3,515 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2025, with 7 findings.

Their research concentrates on SQL Injection, which accounts for 7 of their findings (58%). Other recurring categories include Cross-Site Scripting, Unrestricted Upload Of File With Dangerous Type. The average CVSS score across these disclosures is 6.2, peaking at 8.8. Severity breakdown: 0 critical and 6 high.

The most affected software includes WP Directory Kit (3), Video Gallery (2), AIO Forms (1), across 9 distinct plugins, themes and core versions in total.

All 12 disclosed issues have since received a vendor fix. The most severe finding, "Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic", scores 8.8 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

#377

of 3,515 researchers

Vulns

Critical0

High6

Medium6

Low0

Affected Assets

9plugins

Avg CVSS

6.1

Average score of vulnerabilities

Researcher Submissions

12 records


2026-01-05 14:47	Form Vibes – Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injection Form Vibes <= 1.4.13	`CVE-2025-13409`	4.9 Medium	tmrswrr	Yes
2025-12-12 15:19	WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection WP Directory Kit <= 1.4.7	`CVE-2025-13089`	7.5 High	tmrswrr	Yes
2025-12-01 21:39	WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection WP Directory Kit <= 1.4.6	`CVE-2025-13090`	4.9 Medium	tmrswrr	Yes
2025-11-20 20:36	WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function WP Directory Kit <= 1.4.3	`CVE-2025-13138`	7.5 High	tmrswrr	Yes
2025-11-12 00:00	Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic WP All Import <= 3.9.6	`CVE-2025-12733`	8.8 High	tmrswrr	Yes
2025-10-23 20:07	AIO Forms <= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Import AIO Forms <= 1.3.18	`CVE-2025-11889`	7.2 High	tmrswrr	Yes
2025-10-10 00:00	My Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL Injection My auctions allegro <= 3.6.31	`CVE-2025-10048`	4.9 Medium	tmrswrr	Yes
2025-09-05 00:00	Multi Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload Multi Step Form <= 1.7.25	`CVE-2025-9515`	7.2 High	tmrswrr	Yes
2024-12-05 14:39	YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection Video Gallery <= 2.4.2	`CVE-2024-10247`	7.2 High	tmrswrr	Yes
2024-12-05 14:36	Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Video Gallery <= 2.4.1	`CVE-2024-9769`	4.4 Medium	tmrswrr	Yes

Showing 1–10 of 12 reports