🧹It's time for some spring cleaning! All researchers earn over 6.25x our normal bounty rates, through May 27th, 2024, when Wordfence handles responsible disclosure for our Spring Cleaning Bug Extravaganza! Learn more about our bug bounty program
Register as a researcher and submit your vulnerabilities today!

Wordfence Intelligence > Vulnerability Researchers > Asif Nawaz Minhas

Asif Nawaz Minhas

All Time Ranking

All Time Discoveries

Showing 1-20 of 65 Vulnerabilities

Export any WordPress data to XML/CSV <= 1.3.4 - Authenticated SQL Injection

9.0

CVE-2022-1800

May 20, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

WP CSV Exporter <= 1.3.6 - Authenticated (Admin+) SQL Injection

7.2

CVE-2022-3249

Nov 9, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Export Users With Meta < 0.6.5 - Authenticated (Admin+) SQL Injection

7.2

CVE-2021-24451

Jun 21, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

YITH Maintenance Mode <= 1.3.7 - Stored Cross-Site Scripting

6.9

CVE-2021-36841

Sep 15, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Export All URLs <= 4.2 - Cross-Site Request Forgery to Sensitive Data Export

6.5

CVE-2022-0914

Mar 21, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Coming soon and Maintenance mode <= 3.5.2 - Authenticated Stored Cross-Site Scripting

6.4

CVE-2021-24577

Sep 13, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Easy Accordion <= 2.0.21 - Authenticated Stored Cross-Site Scripting

6.4

CVE-2021-24576

Sep 10, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Business Hours Indicator <= 2.3.4 - Authenticated Stored Cross-Site Scripting

6.4

CVE-2021-24593

Aug 2, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Custom Share Buttons with Floating Sidebar <= 4.1 - Stored Cross-Site Scripting

6.1

CVE-2022-1717

May 18, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Export All URLs <= 4.1 - Reflected Cross-Site Scripting

6.1

CVE-2022-0892

Mar 21, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multisite Content Copier/Updater Pro < 2.1.2 - Reflected Cross-Site Scripting

6.1

CVE-2022-0503

Feb 21, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WordPress Multisite User Sync/Unsync (Premium) <= 2.1.1 Reflected Cross-Site Scripting

6.1

CVE-2021-25038

Feb 7, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multisite Content Copier/Updater <= 1.4.0 - Reflected Cross-Site Scripting

6.1

CVE-2021-25039

Feb 7, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Image Hover Effects <= 5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2022-4010

Nov 20, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Image Hover Effects Css3 <= 4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2022-3601

Nov 3, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Salat Times < = 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2022-2983

Nov 2, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Testimonials (Free <= 2.6, Pro < 1.0.7) - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2022-3539

Oct 20, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

WP Contact Slider <= 2.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2022-3237

Oct 10, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Social Media Follow Buttons Bar <= 4.73 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2021-36839

Sep 27, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Meks Easy Social Share <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVE-2022-2574

Sep 26, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Export any WordPress data to XML/CSV <= 1.3.4 - Authenticated SQL Injection	CVE-2022-1800	9.0	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L	May 20, 2022
WP CSV Exporter <= 1.3.6 - Authenticated (Admin+) SQL Injection	CVE-2022-3249	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 9, 2022
Export Users With Meta < 0.6.5 - Authenticated (Admin+) SQL Injection	CVE-2021-24451	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	June 21, 2021
YITH Maintenance Mode <= 1.3.7 - Stored Cross-Site Scripting	CVE-2021-36841	6.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N	September 15, 2021
Export All URLs <= 4.2 - Cross-Site Request Forgery to Sensitive Data Export	CVE-2022-0914	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	March 21, 2022
Coming soon and Maintenance mode <= 3.5.2 - Authenticated Stored Cross-Site Scripting	CVE-2021-24577	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	September 13, 2021
Easy Accordion <= 2.0.21 - Authenticated Stored Cross-Site Scripting	CVE-2021-24576	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	September 10, 2021
Business Hours Indicator <= 2.3.4 - Authenticated Stored Cross-Site Scripting	CVE-2021-24593	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 2, 2021
Custom Share Buttons with Floating Sidebar <= 4.1 - Stored Cross-Site Scripting	CVE-2022-1717	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	May 18, 2022
Export All URLs <= 4.1 - Reflected Cross-Site Scripting	CVE-2022-0892	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 21, 2022
Multisite Content Copier/Updater Pro < 2.1.2 - Reflected Cross-Site Scripting	CVE-2022-0503	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 21, 2022
WordPress Multisite User Sync/Unsync (Premium) <= 2.1.1 Reflected Cross-Site Scripting	CVE-2021-25038	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 7, 2022
Multisite Content Copier/Updater <= 1.4.0 - Reflected Cross-Site Scripting	CVE-2021-25039	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 7, 2022
Image Hover Effects <= 5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-4010	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	November 20, 2022
Image Hover Effects Css3 <= 4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-3601	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	November 3, 2022
Salat Times < = 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-2983	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	November 2, 2022
Testimonials (Free <= 2.6, Pro < 1.0.7) - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-3539	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	October 20, 2022
WP Contact Slider <= 2.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-3237	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	October 10, 2022
Social Media Follow Buttons Bar <= 4.73 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2021-36839	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	September 27, 2022
Meks Easy Social Share <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-2574	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	September 26, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation