WebARX Security

WebARX Security is a security researcher credited with 7 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #562 of 3,515 contributors. Their disclosures were published between 2018 and 2020. The most productive year was 2020, with 5 findings.

Their research concentrates on Authentication Bypass Using An Alternate Path Or Channel, which accounts for 1 of their findings (14%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor. The average CVSS score across these disclosures is 8.1, peaking at 9.8. Severity breakdown: 2 critical and 3 high.

The most affected software includes WPvivid (2), Backup and Staging by WP Time Capsule (1), FV Flowplayer Video Player (1), across 6 distinct plugins, themes and core versions in total.

All 7 disclosed issues have since received a vendor fix. The most severe finding, "InfiniteWP Client <= 1.9.4.4 - Authentication Bypass", scores 9.8 out of 10.

201820192020

Critical

High

Medium

Low

Global Rank

#562

of 3,515 researchers

Vulns

Critical2

High3

Medium2

Low0

Affected Assets

6plugins

Avg CVSS

8.1

Average score of vulnerabilities

Researcher Submissions

7 records


2020-03-23 00:00	Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure WPvivid < 0.9.36	`CVE-2020-36835`	4.9 Medium	WebARX Security	Yes
2020-03-13 00:00	Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload WPvivid <= 0.9.35	`CVE-2020-36842`	8.8 High	WebARX Security	Yes
2020-01-24 00:00	wpCentral <= 1.4.7 - Privilege Escalation wpCentral < 1.4.8	`N/A`	8.8 High	WebARX Security	Yes
2020-01-14 00:00	InfiniteWP Client <= 1.9.4.4 - Authentication Bypass InfiniteWP Client <= 1.9.4.4	`CVE-2020-8772`	9.8 Critical	WebARX Security	Yes
2020-01-14 00:00	Backup and Staging by WP Time Capsule <= 1.21.15 - Authentication Bypass Backup and Staging by WP Time Capsule < 1.21.16	`CVE-2020-8771`	9.8 Critical	WebARX Security	Yes
2019-05-20 00:00	FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored Cross-Site Scripting FV Flowplayer Video Player <= 7.3.13.727	`CVE-2019-14799`	6.1 Medium	WebARX Security	Yes
2018-12-07 00:00	LoginPress <= 1.1.15 - Authenticated SQL Injection via Settings Import LoginPress < 1.1.16	`CVE-2019-15872`	8.8 High	WebARX Security	Yes

Showing 1–7 of 7 reports