Research · Responsible disclosure

WordPress security in practice.

Guides for WordPress site owners (hacked, malware or Google spam) and CVE research writeups.

2 published

Reflected DOM XSS in JetFormBuilder up to 3.6.6 via query_var and data-jfb-macro. CVSS 4.7, fixed in 3.6.6.1, Wordfence advisory.

IDOR (CWE-639) in the ProfileGrid WordPress plugin up to 6.0.0.2. CVSS 5.3, fixed in 6.0.0.3, Patchstack advisory credited to Zenith.

From writeup to your site

Is your site showing these symptoms?

Send me the link on WhatsApp. I confirm the problem, scope and price before starting. If it's not a fit, I'll say so.