Fixed
CVE-2026-97660
WPC Product Options for WooCommerce
Stored XSS in product options
Details & evidenceCybersecurity · Research & open source
Security.
On the record.
I find vulnerabilities and help get them fixed. My work extends well beyond the CVEs, reports and patches I can share here.
Reviewed on Overall total: my case records
Responsible disclosure
Only part of the work is public.
Many more findings have been acknowledged or rewarded, but their details remain confidential. Ongoing fixes, agreed disclosure timelines and confidentiality obligations determine when I can discuss them.
- Remediation in progress
- Disclosure timelines
- Confidentiality & NDAs
Other reports are still under review. They are not included in the acknowledged-report total.
- Request
- Review
- Approved
CVE / WORDPRESS
Public CVEs5
A CVE is a public record, not the total number of my findings. Explore the IDs, their current status and original sources.
Patch pending
CVE-2026-75098
Product Designer App
Server file protection in a design plugin
Details & evidenceFixed
CVE-2026-81754
Vigilant
Stored XSS in a security plugin
Details & evidenceFixed
CVE-2026-32480
WCFM Membership
Membership access control
Details & evidenceFixed
CVE-2026-57709
Membership for WooCommerce
File protection in a membership plugin
Details & evidencePORTFOLIO / 2026
The work behind it.
CVEs, reports, patches and recognition. Each entry identifies my contribution, its status and the original sources.
69 of 69 matches shown
Stored XSS in product optionsFixed
My finding concerns safe rendering of order data in the WooCommerce plugin. Wordfence and the CVE record credit me with the discovery. The vulnerability was fixed in version 4.0.6.
- My contribution
- Discovered & reported
- Documented on
- Fixed in
- 4.0.6
- Public credit
- Sebastian Albrecht (mySebbe)
Server file protection in a design pluginPatch pending
My reported finding concerns access to server files. Wordfence published it on 29 September 2026, and the CVE record confirms my credit. No patch is known as of this register’s review date.
- My contribution
- Discovered & reported
- Documented on
- Public credit
- Sebastian Albrecht (mySebbe)
Stored XSS in a security pluginFixed
A flaw I reported in the WordPress security plugin’s audit log. Both the CVE record and vendor changelog credit me with the discovery.
- My contribution
- Discovered & reported
- Documented on
- Fixed in
- 2.10.3
- Public credit
- Sebastian Albrecht
Membership access controlFixed
An access-control issue I reported. Patchstack and the vendor acknowledge the finding under my handle mySebbe.
- My contribution
- Discovered & reported
- Documented on
- Fixed in
- 2.12.0
- Public credit
- mySebbe
File protection in a membership pluginFixed
My finding, reported through Patchstack, concerns improper file deletion. The official CVE record credits me as sebbe_alb.
- My contribution
- Discovered & reported
- Documented on
- Fixed in
- 3.1.1
- Public credit
- sebbe_alb
Vigilant finding in Wordfence’s weekly reportPublished
The official weekly report documents my published finding and names Sebastian Albrecht in its researcher list. Both the article and my researcher profile are linked.
- My contribution
- Named in publication
- Documented on
Apply authentication checks consistentlyFixed
A vendor fix in NodeBB 4.16.0 addressed my reported finding. The public sources document the added integration of plugin checks. The vendor confirmed the connection to my report; the code was written by the NodeBB team.
- My contribution
- Reported · vendor fix
- Documented on
- Fixed in
- 4.16.0
Federation respects category boundariesMerged
My merged patch prevents crossposts into non-federated categories from being federated onward.
- My contribution
- My code & tests
- Documented on
Safe rendering of WooCommerce order dataFixed
The vendor acknowledges my responsible disclosure in the 1.36.11 changelog. The fix prevents stored XSS when displaying order data. A public CVE credit has not been established for this finding.
- My contribution
- Discovered & reported
- Documented on
- Fixed in
- 1.36.11
- Public credit
- Sebastian Albrecht
WCFM finding in Wordfence’s weekly reportPublished
The official weekly report documents my published finding and names Sebastian Albrecht in its researcher list. Both the article and my researcher profile are linked.
- My contribution
- Named in publication
- Documented on
Protect user roles in legacy payment flowsFixed
The vendor credits mySebbe for a second security fix protecting against unauthorized changes to user roles in legacy payment flows. Version 2.12.0 retires the affected old handlers. This changelog entry is distinct from the access-control issue CVE-2026-32480; no additional CVE attribution has been verified.
- My contribution
- Discovered & reported
- Documented on
- Fixed in
- 2.12.0
- Public credit
- mySebbe (Patchstack)
Safe return paths after loginMerged
My patch and tests restrict return destinations to internal paths. The contribution was merged into NodeBB.
- My contribution
- My code & tests
- Documented on
Permissions for sensitive configuration filesPublished
My public report documents overly broad file permissions in the VPS installer and recommends restrictive permissions and regression checks. The issue is closed; that alone does not establish a confirmed vendor fix.
- My contribution
- Investigated & publicly reported
- Documented on
Robust file timestamp handlingReport open
Public report about a backup crash on file timestamps that cannot be represented. I explicitly describe this as a reliability issue without claiming broader security impact.
- My contribution
- My bug report
- Documented on
Memory lifetime in network statisticsFixed
Network-statistics output accessed memory that had already been released. My public report and the associated merged vendor fix document the correction.
- My contribution
- My bug report
- Documented on
- Public credit
- Sebastian Albrecht
Safe report processingFixed
My reported finding led to changes in report processing. The public vendor patch restricts accepted fields and strengthens authorization checks.
- My contribution
- Reported · vendor fix
- Documented on
Correct date-filter interpretationReport open
I document date parsing that interprets a year as a time of day and can consequently omit files from a backup.
- My contribution
- My bug report
- Documented on
File descriptors on error pathsReport open
My report examines file-descriptor lifetime after a network-connection setup failure. The public discussion remains open.
- My contribution
- My bug report
- Documented on
Verifiable identity links in profilesMerged
My merged fix restores rel="me" on the profile website link, allowing identity linking such as Mastodon verification to work again. Other profile links are not automatically treated as identity assertions.
- My contribution
- Contributed code
- Documented on
Verifiable identity links in profilesMerged
My merged fix restores rel="me" on the profile website link, allowing identity linking such as Mastodon verification to work again. Other profile links are not automatically treated as identity assertions.
- My contribution
- Contributed code
- Documented on
Manage category permissions through the APIMerged
My merged contribution exposes category-permission copying through the v3 API. It retains existing administrator checks and validates inputs, adding an administration feature with explicit permission boundaries.
- My contribution
- Contributed code
- Documented on
Report unreadable input files as errorsReport open
My report identifies how an unreadable input file can be omitted while the backup run reports success.
- My contribution
- My bug report
- Documented on
Detect archive-building allocation failuresReport open
I describe how a memory-allocation failure during archive-header creation can result in a success status despite an unreadable archive stream.
- My contribution
- My bug report
- Documented on
Check key compatibility before archive migrationReport open
My report examines archive migration with incompatible key sets, focusing on data integrity and the ordering of validation and deletion.
- My contribution
- My bug report
- Documented on
PostgreSQL guide for NodeBBMerged
My merged documentation contribution explains running NodeBB with PostgreSQL.
- My contribution
- My documentation
- Documented on
Reset passwords using a usernameIn review
My draft adds usernames as a way to request password recovery. Consistent responses and existing limits are intended to preserve account privacy. The pull request remains open and has not been merged.
- My contribution
- Submitted a code draft
- Documented on
Robust cryptographic key exportFixed
My public report concerns a crash during key export. The vendor merged the fix in pull request #808 on 22 September 2026.
- My contribution
- Reported · vendor fix
- Documented on
- Public credit
- Sebastian Albrecht
Validate stored chunk flagsFixed
My report concerns invalid flags in stored chunk metadata and their effect on memory management. The vendor fix validates this data when it is read.
- My contribution
- My bug report
- Documented on
- Public credit
- Sebastian Albrecht
Unambiguous CSV output pathsReport open
My report examines relative CSV-output paths when the working directory changes, including unintended file overwrites.
- My contribution
- My bug report
- Documented on
Key-file input validationReport open
I documented late rejection of an empty key-file path. The report focuses on early, unambiguous input validation.
- My contribution
- My bug report
- Documented on
Local consistency during key rotationReport open
My follow-up report on key rotation examines consistency between remote deletions and locally stored chunk directories.
- My contribution
- My bug report
- Documented on
Transaction data during recoveryReport open
I document a transaction-data mix-up when recovering a saved checkpoint.
- My contribution
- My bug report
- Documented on
Relative time boundary handlingReport open
My report examines large relative time offsets and error handling during time conversion.
- My contribution
- My bug report
- Documented on
Error paths in archive checksReport open
I examine an allocation-failure path during archive consistency checks and its implications for existing data chunks.
- My contribution
- My bug report
- Documented on
Stored chunk metadata consistencyReport open
My report follows corrupted size metadata from the chunk cache into newly generated archive indexes.
- My contribution
- My bug report
- Documented on
Evaluate relative date filters correctlyReport open
I documented incorrect evaluation of relative dates. An incorrect cutoff can cause a backup to find no matching files.
- My contribution
- My bug report
- Documented on
Support timestamps beyond 2038Report open
My report examines date handling beyond 2038 on systems with 64-bit time values.
- My contribution
- My bug report
- Documented on
Detect corrupted cache metadataReport open
I document how corrupted cache metadata can block subsequent backups when the client continues treating it as available.
- My contribution
- My bug report
- Documented on
Detect date overflowsReport open
Public report on validation of very large numeric date inputs, aimed at detecting invalid time values early.
- My contribution
- My bug report
- Documented on
Key-generation error handlingFixed
My public report documents an issue in key generation and cleanup after an error. The vendor merged the fix in pull request #878.
- My contribution
- Reported · vendor fix
- Documented on
- Public credit
- Sebastian Albrecht
Safely release metadata after output errorsFixed
I reported a problem with cleaning up archive metadata after an output failure. The merged vendor patch corrects the affected error path.
- My contribution
- My bug report
- Documented on
- Public credit
- Sebastian Albrecht
Expose read errors during archivingReport open
I document handling of read errors during backup. The report examines whether incorrect data can appear to have been archived successfully.
- My contribution
- My bug report
- Documented on
Consistency after power lossFixed
I documented a mismatch between a remote transaction and the local chunk directory after power loss. The merged correction improves durable storage of local directory changes.
- My contribution
- My bug report
- Documented on
- Public credit
- Sebastian Albrecht
Consistent signature identity handlingFixed
I reported inconsistent interpretation of signature identities. The public vendor fix aligns the middleware’s interpretation with the library.
- My contribution
- Reported · vendor fix
- Documented on
Regression tests for reset tokensMerged
My tests verify that removing an email address also clears its associated reset tokens.
- My contribution
- My code & tests
- Documented on
Regression tests for account switchingMerged
I contributed regression tests for session tracking when switching accounts. The vendor fix and my tests are separate contributions.
- My contribution
- My code & tests
- Documented on
Apply chat policy to ActivityPub messagesFixed
My report concerns enforcement of local chat rules for federated messages. The vendor fix incorporates existing messaging policies into the check.
- My contribution
- Reported · vendor fix
- Documented on
Tests for federated messages and chat rulesIn review
My public test contribution adds regression coverage for origin checks and chat policies. The pull request is still open.
- My contribution
- My tests · in review
- Documented on
Access boundaries for ActivityPub activitiesFixed
My reported finding concerns access boundaries for federated activities. The public vendor commit restricts processing of the affected Announce activities.
- My contribution
- Reported · vendor fix
- Documented on
Enforce registration policy through completionMerged
My change rechecks registration and invitation policies before a pending registration is completed.
- My contribution
- My code & tests
- Documented on
Recheck deletion state before live updatesMerged
My patch revalidates deletion state before an edited post is broadcast.
- My contribution
- My code & tests
- Documented on
Public credit for a debt-accounting findingAcknowledged
The project credits my report about a debt-accounting flaw in its security documentation, linking directly to my mySebbe GitHub profile. This acknowledgement does not establish a CVE, fixed version or payment.
- My contribution
- Discovered & reported
- Documented on
- Public credit
- mySebbe
Mention in Wordfence’s weekly reportPublished
Wordfence lists me as sebbe_alb among the researchers contributing during July 6–12, 2026. The article links my researcher profile and associated finding.
- My contribution
- Named in publication
- Documented on
Verify federated author originsFixed
My reported finding concerns federated author attribution. The vendor fix verifies that the origin matches the authenticated sender.
- My contribution
- Reported · vendor fix
- Documented on
Remove IP addresses from edit eventsFixed
My report concerns unnecessary exposure of IP addresses in post-edit events. The public vendor fix removes that information.
- My contribution
- Reported · vendor fix
- Documented on
Coverage of my GitHub bug reportPublished
This article discusses my public report about inconsistencies in GitHub’s private vulnerability reporting. It is coverage of my contribution, not a CVE or a security award.
- My contribution
- Coverage of my contribution
- Documented on
Respect group permissions in the APIFixed
I reported a finding about group visibility in the API. The vendor fix enforces the permission to view groups.
- My contribution
- Reported · vendor fix
- Documented on
Check read permissions for post revisionsFixed
My report concerns read access to earlier post revisions. The public vendor fix checks topic permissions before loading them.
- My contribution
- Reported · vendor fix
- Documented on
Handle configuration errors cleanlyFixed
An incomplete configuration could crash the client. My report led to validation of missing arguments; the correction has been merged.
- My contribution
- My bug report
- Documented on
A reachable channel for security reportsReport open
I publicly documented that the published security contact could not receive a report. The issue requests a working confidential reporting channel without disclosing unpublished vulnerability details. It remains open.
- My contribution
- Checked the reporting channel and reported the problem
- Documented on
Identify misleading health-check alertsFixed
The official v2026.5.2-beta.3 release notes credit my report about a legacy connection health check. The project added a warning for an old diagnostic that could incorrectly report an inactive gateway. A documented operational-reliability contribution.
- My contribution
- Reported the bug · credited in the release
- Documented on
- Public credit
- mySebbe
Reliably renew OAuth sessionsFixed
I reported a failure in automatic Gemini OAuth session renewal. The project’s fix, merged on 16 May 2026, explicitly closes my report #42541. This is a contribution to login reliability, with no CVE claim.
- My contribution
- Reported the bug · fix by the project
- Documented on
Correctly recognize available AI modelsFixed
My public bug report documented an outdated Gemini model catalog. The project’s fix, merged on 5 April 2026, explicitly closes my report #35274. This corrects AI integration behavior and is not a security vulnerability.
- My contribution
- Reported the bug · fix by the project
- Documented on
Review AI tool permission signalsPublished
My tool checks MCP descriptions and schemas for risky permission signals. It supports reviews and does not replace runtime authorization checks.
- My contribution
- Built & maintained
Validate MCP capability reportsPublished
My public Python utility validates JSON reports describing MCP tools, resources and prompts. It provides text or machine-readable results and can treat warnings as errors in strict CI checks. It validates report structures, not the security of a remote server.
- My contribution
- Own open-source utility
Public researcher profile and monthly leaderboardAcknowledged
Patchstack lists my researcher profile and published credits. Its June 2026 monthly leaderboard places me at rank 21 with 26 AXP and two reports. This is a dated leaderboard entry; each linked CVE is counted only once in this register.
- My contribution
- Publicly listed researcher
- Public credit
- mySebbe
Share logs. Keep secrets.Published
My tool for redacting common secrets and personal data from text and JSONL logs, with custom rules and a CI check mode.
- My contribution
- Built & maintained
Bug bounty hall of fameAcknowledged
The QRL Foundation lists me as mySebbe in its official hall of fame. The linked page documents the public acknowledgment.
- My contribution
- Publicly acknowledged
Official bug bounty acknowledgementAcknowledged
Synology lists my name and alias in its official 2026 acknowledgements. These two name entries count as one recognition here. This does not disclose any confidential individual reports.
- My contribution
- Publicly acknowledged security researcher
- Public credit
- Sebastian "mySebbe" Albrecht · Sebastian Albrecht
69 / 69
About this register
The overall total counts each currently accepted or rewarded case in my records once. It includes public and non-public reports. The register counts individual public contributions, including code, articles and open reports. Subtracting one total from the other would not give a meaningful result.
Register totals are calculated from its entries. Each CVE ID counts once; multiple sources do not increase the count. Publication status, open reports, vendor fixes and my own code are distinguished. The acknowledged-report total comes from my case records on the stated review date and is not a count of public CVEs.
Published as Sebastian Albrecht, Sebastian mySebbe Albrecht, mySebbe and sebbe_alb.
Web · Cloud · AI
What needs to be safer?
Let’s talk about your system, your code or your next idea.