Wordfence Intelligence   >   Vulnerability Researchers   >   Ananda Dhakal

Ananda Dhakal

97
All Time Ranking
26
All Time Discoveries

Showing 1-20 of 26 Vulnerabilities

Smartsupp – live chat, chatbots, AI and lead generation <= 3.6 - Cross-Site Request Forgery
4.3
CVE-2024-38790
Jul 20, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
JSON Content Importer <= 1.5.6 - Authenticated (Contributor+) Server-Side Request Forgery
6.4
CVE-2024-38723
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Booking Ultra Pro <= 1.1.13 - Unauthenticated Local File Inclusion
9.8
CVE-2024-38717
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization
5.3
CVE-2024-38743
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2024-38744
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
ReDi Restaurant Reservation <= 24.0422 - Missing Authorization
5.3
CVE-2024-38737
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Leaky Paywall <= 4.21.2 - Cross-Site Request Forgery
4.3
CVE-2024-37540
Jul 6, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WooCommerce Social Login <= 2.6.3 - Unauthenticated PHP Object Injection
9.8
CVE-2024-37502
Jul 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Groundhogg <= 3.4.2.3 - Reflected Cross-Site Scripting
6.1
CVE-2024-37264
Jun 27, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
FS Poster <= 6.5.8 - Cross-Site Request Forgery
4.3
CVE-2024-37237
Jun 21, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery
4.3
CVE-2024-37235
Jun 21, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
ElasticPress <= 5.1.0 - Cross-Site Request Forgery
4.3
CVE-2024-35684
Jun 6, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Database Cleaner <= 1.0.5 - Authenticated (Admin+) Arbitrary File Read
4.9
CVE-2024-35712
Jun 6, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Aiomatic <= 1.9.3 - Missing Authorization
4.3
CVE-2024-34435
May 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
BP Better Messages <= 2.4.32 - Missing Authorization
5.3
CVE-2024-32802
Apr 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WP Travel Engine <= 5.8.0 - Unauthenticated Price Manipulation
5.3
CVE-2024-32798
Apr 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Really Simple SSL <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery
5.5
CVE-2024-31229
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Asgaros Forum <= 2.8.0 - Cross-Site Request Forgery
4.3
CVE-2024-32440
Apr 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Cross-Site Request Forgery
5.3
CVE-2024-32105
Apr 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Slideshow Gallery <= 1.8 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-31353
Apr 7, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
Smartsupp – live chat, chatbots, AI and lead generation <= 3.6 - Cross-Site Request Forgery CVE-2024-38790 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 20, 2024
JSON Content Importer <= 1.5.6 - Authenticated (Contributor+) Server-Side Request Forgery CVE-2024-38723 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Booking Ultra Pro <= 1.1.13 - Unauthenticated Local File Inclusion CVE-2024-38717 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H July 11, 2024
Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization CVE-2024-38743 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 11, 2024
Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting CVE-2024-38744 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 11, 2024
ReDi Restaurant Reservation <= 24.0422 - Missing Authorization CVE-2024-38737 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 11, 2024
Leaky Paywall <= 4.21.2 - Cross-Site Request Forgery CVE-2024-37540 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 6, 2024
WooCommerce Social Login <= 2.6.3 - Unauthenticated PHP Object Injection CVE-2024-37502 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H July 5, 2024
Groundhogg <= 3.4.2.3 - Reflected Cross-Site Scripting CVE-2024-37264 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N June 27, 2024
FS Poster <= 6.5.8 - Cross-Site Request Forgery CVE-2024-37237 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N June 21, 2024
Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery CVE-2024-37235 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N June 21, 2024
ElasticPress <= 5.1.0 - Cross-Site Request Forgery CVE-2024-35684 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N June 6, 2024
Database Cleaner <= 1.0.5 - Authenticated (Admin+) Arbitrary File Read CVE-2024-35712 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N June 6, 2024
Aiomatic <= 1.9.3 - Missing Authorization CVE-2024-34435 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N May 7, 2024
BP Better Messages <= 2.4.32 - Missing Authorization CVE-2024-32802 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 22, 2024
WP Travel Engine <= 5.8.0 - Unauthenticated Price Manipulation CVE-2024-32798 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 22, 2024
Really Simple SSL <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery CVE-2024-31229 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N April 16, 2024
Asgaros Forum <= 2.8.0 - Cross-Site Request Forgery CVE-2024-32440 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 12, 2024
ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Cross-Site Request Forgery CVE-2024-32105 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 11, 2024
Slideshow Gallery <= 1.8 - Unauthenticated Sensitive Information Exposure CVE-2024-31353 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 7, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation