Wordfence Intelligence   >   Vulnerability Researchers   >   João Pedro Soares de Alcântara

João Pedro Soares de Alcântara

Organization: Kinorth

1
All Time Ranking
1007
All Time Discoveries
2
90 Day Published Submissions
28 May '26
Last Published Submission

About

My name is João Pedro Soares de Alcântara, i'm a bug bounty hunter, ethical hacker, RPA developer, and I hold a Bachelor’s degree in Computer Engineering.

4 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
April 18, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
April 9, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
March 20, 2024
Learn more Learn more about Achievements

Showing 1-20 of 1,007 Vulnerabilities

Moderno < 1.43 - Unauthenticated PHP Object Injection
8.1
CVE-2026-49108
Jun 4, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Enfold - Responsive Multi-Purpose Theme <= 7.1.4 - Reflected Cross-Site Scripting
6.1
CVE-2026-48869
Jun 1, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
6.4
CVE-2026-9243
May 28, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Grand Car Rental | Limousine HTML Template <= 3.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-69151
May 28, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
SeedProd Pro < 6.19.5 - Authenticated (Contributor+) Local File Inclusion
7.5
CVE-2026-48972
May 27, 2026
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Roneous - Creative Multi-Purpose WordPress Theme <= 2.1.5 - Unauthenticated Local File Inclusion
8.1
CVE-2025-69177
May 27, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Truemag <= 4.3.14.2 - Unauthenticated Local File Inclusion
8.1
CVE-2025-69178
May 27, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Woocommerce Envato Affiliates <= 1.2.1 - Missing Authorization
4.3
CVE-2025-14361
May 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SweetDate Core < 1.1.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-69140
May 26, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SW Core <= 1.7.18 - Authenticated (Contributor+) Local File Inclusion
7.5
CVE-2026-39661
May 26, 2026
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Nyla <= 1.7 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVE-2026-39642
May 26, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Mayosis Core <= 5.4.7 - Missing Authorization
5.3
CVE-2026-39655
May 26, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
6.4
CVE-2026-6646
May 14, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Avante < 3.0.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-68524
May 8, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Flipmart <= 2.8 - Missing Authorization
5.3
CVE-2026-39716
May 2, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Profile Builder Pro <= 3.15.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-42385
Apr 27, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
TheGem Theme Elements < 5.12.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-42410
Apr 27, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Avada < 7.13.2 - Cross-Site Request Forgery
4.3
CVE-2025-58922
Apr 22, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Atomlab <= 2.4.5 - Unauthenticated Local File Inclusion
8.1
CVE-2026-39590
Apr 20, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ChapterOne <= 1.7 - Unauthenticated Local File Inclusion
8.1
CVE-2026-40731
Apr 16, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
Moderno < 1.43 - Unauthenticated PHP Object Injection CVE-2026-49108 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H June 4, 2026
Enfold - Responsive Multi-Purpose Theme <= 7.1.4 - Reflected Cross-Site Scripting CVE-2026-48869 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N June 1, 2026
The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter CVE-2026-9243 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 28, 2026
Grand Car Rental | Limousine HTML Template <= 3.7 - Unauthenticated Stored Cross-Site Scripting CVE-2025-69151 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N May 28, 2026
SeedProd Pro < 6.19.5 - Authenticated (Contributor+) Local File Inclusion CVE-2026-48972 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H May 27, 2026
Roneous - Creative Multi-Purpose WordPress Theme <= 2.1.5 - Unauthenticated Local File Inclusion CVE-2025-69177 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H May 27, 2026
Truemag <= 4.3.14.2 - Unauthenticated Local File Inclusion CVE-2025-69178 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H May 27, 2026
Woocommerce Envato Affiliates <= 1.2.1 - Missing Authorization CVE-2025-14361 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N May 26, 2026
SweetDate Core < 1.1.5 - Reflected Cross-Site Scripting CVE-2025-69140 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N May 26, 2026
SW Core <= 1.7.18 - Authenticated (Contributor+) Local File Inclusion CVE-2026-39661 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H May 26, 2026
Nyla <= 1.7 - Unauthenticated Arbitrary Shortcode Execution CVE-2026-39642 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N May 26, 2026
Mayosis Core <= 5.4.7 - Missing Authorization CVE-2026-39655 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N May 26, 2026
The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter CVE-2026-6646 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 14, 2026
Avante < 3.0.5 - Reflected Cross-Site Scripting CVE-2025-68524 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N May 8, 2026
Flipmart <= 2.8 - Missing Authorization CVE-2026-39716 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N May 2, 2026
Profile Builder Pro <= 3.15.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-42385 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N April 27, 2026
TheGem Theme Elements < 5.12.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-42410 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 27, 2026
Avada < 7.13.2 - Cross-Site Request Forgery CVE-2025-58922 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 22, 2026
Atomlab <= 2.4.5 - Unauthenticated Local File Inclusion CVE-2026-39590 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H April 20, 2026
ChapterOne <= 1.7 - Unauthenticated Local File Inclusion CVE-2026-40731 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H April 16, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation