xiahao

xiahao is a security researcher credited with 7 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #602 of 3,515 contributors. The disclosure was published in 2021.

Their research concentrates on Cross-Site Scripting, which accounts for 6 of their findings (86%). Other recurring categories include SQL Injection. The average CVSS score across these disclosures is 6.0, peaking at 8.8. Severity breakdown: 0 critical and 1 high.

The most affected software includes Availability Calendar (2), Alojapro Booking Engine (1), Highlight Sitewide Notice (1), across 6 distinct plugins, themes and core versions in total.

All 7 disclosed issues have since received a vendor fix. The most severe finding, "Availability Calendar < 1.2.1 - SQL Injection", scores 8.8 out of 10.

2021

Critical

High

Medium

Low

Global Rank

#602

of 3,515 researchers

Vulns

Critical0

High1

Medium6

Low0

Affected Assets

6plugins

Avg CVSS

6.0

Average score of vulnerabilities

Researcher Submissions

7 records


2021-08-06 00:00	Highlight < 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting Highlight Sitewide Notice < 0.9.3	`CVE-2021-24591`	5.5 Medium	xiahao	Yes
2021-08-05 00:00	Mapa Politico España < 3.7.0 - Stored Cross-Site Scripting WP Mapa Politico España < 3.7.0	`CVE-2021-24609`	5.5 Medium	xiahao	Yes
2021-08-04 00:00	Availability Calendar < 1.2.1 - SQL Injection Availability Calendar < 1.2.1	`CVE-2021-24606`	8.8 High	xiahao	Yes
2021-08-03 00:00	Availability Calendar <= 1.2.1 - Stored Cross-Site Scripting Availability Calendar <= 1.2.1	`CVE-2021-24604`	5.5 Medium	xiahao	Yes
2021-07-30 00:00	youForms for WordPress – Creating Forms for CopeCart <= 1.0.5 - Stored Cross-Site Scripting youForms for WordPress <= 1.0.5	`CVE-2021-24596`	5.5 Medium	xiahao	Yes
2021-07-29 00:00	Alojapro Widget <= 1.1.15 - Authenticated (Admin+) Stored Cross-Site Scripting Alojapro Booking Engine <= 1.1.15	`CVE-2021-24530`	5.5 Medium	xiahao	Yes
2021-07-29 00:00	Splash Header < 1.20.8 - Stored Cross-Site Scripting Splash Header < 1.20.8	`CVE-2021-24587`	5.5 Medium	xiahao	Yes

Showing 1–7 of 7 reports