WPScanTeam

WPScanTeam is a security researcher credited with 288 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #26 of 3,515 contributors. Their disclosures were published between 2019 and 2023. The most productive year was 2021, with 172 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 141 of their findings (49%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization. The average CVSS score across these disclosures is 6.8, peaking at 9.8. Severity breakdown: 9 critical and 89 high.

The most affected software includes Booster Plus for WooCommerce (5), MultiVendorX (5), Social Slider Feed (5), across 244 distinct plugins, themes and core versions in total.

253 of the 288 disclosed issues have a vendor fix, while 35 remain unpatched. The most severe finding, "WooLentor <= 2.5.3 - PHP Object Injection", scores 9.8 out of 10.

20192020202120222023

Critical

High

Medium

Low

Global Rank

#26

of 3,515 researchers

Vulns

288

Critical9

High89

Medium190

Low0

Affected Assets

336

291plugins45themes

Avg CVSS

6.8

Average score of vulnerabilities

Researcher Submissions

288 records


2023-07-10 00:00	Multiple Addify Plugins <= (Various Versions) - Cross-Site Request Forgery Custom Registration Forms Builder… < 1.0.2	`CVE-2022-4888`	4.3 Medium	WPScanTeam	Yes
2023-05-11 00:00	AccessPress Anonymous Post <= 2.8.4 - Authenticated (Contributor+) Arbitrary Redirect Frontend Post WordPress Plugin <= 2.8.4	`CVE-2022-4946`	4.3 Medium	WPScanTeam	No
2023-05-02 00:00	HollerBox <= 2.1.3 - Authenticated (edit_popups+) SQL Injection HollerBox < 2.1.4	`CVE-2023-2111`	6.6 Medium	WPScanTeam	Yes
2023-04-19 00:00	Kiwiz - Certification de facturation - Woocommerce <= 2.1.3 - Unauthenticated Arbitrary File Download Kiwiz - Certification de facturation… <= 2.1.3	`CVE-2023-2180`	7.5 High	WPScanTeam	No
2023-04-19 00:00	WooCommerce Order Status Change Notifier <= 1.1.0 - Authenticated (Subscriber+) Arbitrary Order Status Update WooCommerce Order Status Change Notifier <= 1.1.0	`CVE-2023-2179`	4.3 Medium	WPScanTeam	No
2023-02-28 00:00	WP Plugin Manager <= 1.1.7 - Cross-Site Request Forgery to Arbitrary Plugin Activation WP Plugin Manager <= 1.1.7	`CVE-2023-1088`	4.3 Medium	WPScanTeam	Yes
2023-02-28 00:00	Preview Link Generator <= 1.0.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation Preview Link Generator <= 1.0.3	`CVE-2023-1086`	4.3 Medium	WPScanTeam	Yes
2023-02-28 00:00	WC Sales Notification <= 1.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation WC Sales Notification <= 1.2.2	`CVE-2023-1087`	4.3 Medium	WPScanTeam	Yes
2023-02-23 00:00	Coupon Zen <= 1.0.5 - Cross-Site Request Forgery to Plugin Activation Coupon Zen <= 1.0.5	`CVE-2023-1089`	4.3 Medium	WPScanTeam	Yes
2023-01-30 00:00	BackupBuddy <= 8.8.2 - Reflected Cross-Site Scripting BackupBuddy <= 8.8.2	`CVE-2022-4897`	6.1 Medium	WPScanTeam	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 288 records. Every record has its own page and is listed in the sitemap.