wesley (wcraft)

wesley (wcraft) is a security researcher credited with 344 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #25 of 3,899 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2024, with 272 findings.

Their research concentrates on Improper Neutralization Of Input During Web Page Generation, which accounts for 217 of their findings (63%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.7, peaking at 9.8. Severity breakdown: 19 critical and 64 high.

The most affected software includes Essential Addons for Elementor (8), HappyAddons for Elementor (8), HT Mega Addons for Elementor (8), across 183 distinct plugins, themes and core versions in total.

339 of the 344 disclosed issues have a vendor fix, while 5 remain unpatched. The most severe finding, "WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion", scores 9.8 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

#25

of 3,899 researchers

Vulns

344

Critical19

High64

Medium260

Low1

Affected Assets

184

181plugins3themes

Avg CVSS

6.7

Average score of vulnerabilities

Researcher Submissions

344 records


2026-10-15 16:55	Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant Lightweight Cookie Notice <= 1.19	`CVE-2026-12272`	5.3 Medium	wesley (wcraft)	Yes
2026-07-08 20:45	Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint Divi Torque Lite <= 4.2.3	`CVE-2026-4275`	8.8 High	wesley (wcraft)	Yes
2026-07-02 21:01	RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter RTMKit for Elementor <= 2.0.7	`CVE-2026-5137`	4.3 Medium	wesley (wcraft)	Yes
2026-06-15 17:15	RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter RTMKit for Elementor <= 2.0.7	`CVE-2026-5149`	6.5 Medium	wesley (wcraft)	Yes
2026-06-09 20:03	Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter Newsletters <= 4.13	`CVE-2026-3018`	7.5 High	wesley (wcraft)	Yes
2026-05-19 00:00	Creative Mail <= 1.6.9 - Unauthenticated SQL Injection Creative Mail <= 1.6.9	`CVE-2026-3430`	7.5 High	wesley (wcraft)	No
2026-04-01 19:07	W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header W3 Total Cache <= 2.9.3	`CVE-2026-5032`	7.5 High	wesley (wcraft)	Yes
2026-03-20 15:20	WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting WP-WebAuthn <= 1.3.4	`CVE-2025-13910`	6.1 Medium	wesley (wcraft)	No
2025-12-15 00:00	WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP WPCOM Member <= 1.7.16	`CVE-2025-14002`	8.1 High	wesley (wcraft)	Yes
2025-12-11 00:00	Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover Comments <= 7.6.39	`CVE-2025-13820`	8.1 High	wesley (wcraft)	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 344 records. Every record has its own page and is listed in the sitemap.