Universe

Universe is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #526 of 3,515 contributors. Their disclosures were published between 2022 and 2023. The most productive year was 2022, with 6 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 3 of their findings (38%). Other recurring categories include Code Injection, Improper Neutralization Of Formula Elements In A CSV File. The average CVSS score across these disclosures is 6.6, peaking at 9.1. Severity breakdown: 1 critical and 2 high.

The most affected software includes Export All URLs (2), Uploading SVG, WEBP and ICO files (2), Activity Log (1), across 6 distinct plugins, themes and core versions in total.

All 8 disclosed issues have since received a vendor fix. The most severe finding, "WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution", scores 9.1 out of 10.

20222023

Critical

High

Medium

Low

Global Rank

#526

of 3,515 researchers

Vulns

Critical1

High2

Medium5

Low0

Affected Assets

6plugins

Avg CVSS

6.6

Average score of vulnerabilities

Researcher Submissions

8 records


2023-12-05 00:00	Code Embed <= 2.3.6 - Authenticated(Contributor+) Denial of Service Code Embed <= 2.3.6	`CVE-2023-49837`	6.5 Medium	Universe	Yes
2023-03-02 00:00	Instant Images <= 5.1.0.1 - Authenticated (Author+) Server-Side Request Forgery via instant_images_download Instant Images <= 5.1.0.1	`CVE-2023-27451`	5.4 Medium	Universe	Yes
2022-09-26 00:00	Activity Log <= 2.8.3 - CSV Injection Activity Log <= 2.8.3	`CVE-2022-27858`	8.3 High	Universe	Yes
2022-08-12 00:00	Uploading SVG, WEBP and ICO files <= 1.0.1 - Arbitrary File Upload Uploading SVG, WEBP and ICO files <= 1.0.1	`CVE-2022-36285`	7.2 High	Universe	Yes
2022-08-12 00:00	Uploading SVG, WEBP and ICO files <= 1.0.1 - Authenticated Stored Cross-Site Scripting Uploading SVG, WEBP and ICO files <= 1.0.1	`CVE-2022-34648`	5.5 Medium	Universe	Yes
2022-06-28 00:00	WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution WP All Import <= 3.6.7	`CVE-2022-36386`	9.1 Critical	Universe	Yes
2022-05-27 12:58	Export All URLs <= 4.1 - Authenticated (Editor+) Stored Cross-Site Scripting Export All URLs <= 4.1	`CVE-2022-27856`	6.4 Medium	Universe	Yes
2022-05-27 00:00	Export All URLs <= 4.1 - Authenticated (Editor+) Stored Cross-Site Scripting Export All URLs <= 4.1	`CVE-2022-29452`	4.4 Medium	Universe	Yes

Showing 1–8 of 8 reports