UKO

UKO is a security researcher credited with 18 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #286 of 3,515 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2024, with 11 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 17 of their findings (94%). Other recurring categories include Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.1, peaking at 8.8. Severity breakdown: 0 critical and 1 high.

The most affected software includes Add Chat App Button (1), Ads.txt & App-ads.txt Manager… (1), AI Engine (1), across 18 distinct plugins, themes and core versions in total.

13 of the 18 disclosed issues have a vendor fix, while 5 remain unpatched. The most severe finding, "AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match", scores 8.8 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

#286

of 3,515 researchers

Vulns

Critical0

High1

Medium17

Low0

Affected Assets

18plugins

Avg CVSS

5.1

Average score of vulnerabilities

Researcher Submissions

18 records


2026-09-04 19:36	Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute Gallery <= 3.3.2	`CVE-2026-85414`	6.4 Medium	UKO	Yes
2026-08-18 17:52	EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content EWWW Image Optimizer <= 8.7.3	`CVE-2026-15446`	6.4 Medium	UKO	Yes
2026-07-31 18:40	AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match AI Engine <= 3.6.5	`CVE-2026-15988`	8.8 High	UKO	Yes
2026-06-05 14:17	EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute EmbedPress <= 4.5.3	`CVE-2026-7796`	6.4 Medium	UKO	Yes
2025-03-31 00:00	Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting Media Library Assistant <= 3.24	`CVE-2025-31627`	4.4 Medium	UKO	Yes
2025-01-24 00:00	Nested Pages <= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting Nested Pages <= 3.2.9	`CVE-2025-24579`	4.4 Medium	UKO	Yes
2025-01-14 00:00	WordPress HelpDesk & Support Ticket System Plugin – Octrace Support <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting WordPress HelpDesk & Support Ticket… <= 1.2.7	`CVE-2025-22762`	4.4 Medium	UKO	No
2024-11-20 00:00	Dynamic "To Top" 3.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting Dynamic "To Top" Plugin 3.5.2	`CVE-2024-52494`	4.4 Medium	UKO	No
2024-11-20 00:00	Add Chat App Button <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting Add Chat App Button <= 2.1.5	`CVE-2024-52489`	4.4 Medium	UKO	Yes
2024-11-20 00:00	Meteor Slides <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting Meteor Slides <= 1.5.7	`CVE-2024-52493`	4.4 Medium	UKO	No

Showing 1–10 of 18 reports