Wordfence Intelligence   >   Vulnerability Researchers   >   Bob Matyas

Bob Matyas

Organization: Automattic

15
All Time Ranking
272
All Time Discoveries
0
90 Day Published Submissions
N/A
Last Published Submission

Showing 1-20 of 272 Vulnerabilities

WP MediaTagger <= 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-13101
Jan 10, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-12722
Jan 10, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WordPress连接微博 <= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-12282
Jan 7, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Competition Form <= 2.0 - Cross-Site Request Forgery to Competition Deletion
4.3
CVE-2024-12750
Jan 7, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Social Share Buttons for WordPress <= 2.7 - Missing Authorization to Unauthenticated Image Upload & Path Traversal
5.3
CVE-2024-13117
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Social Share Buttons for WordPress <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-12807
Jan 6, 2025
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Dyn Business Panel <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-13057
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Dyn Business Panel <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-13056
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Triggers Lite <= 2.5.3 - Authenticated (Admin+) SQL Injection
4.9
CVE-2024-13095
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Altra Side Menu <= 2.0 - Cross-Site Request Forgery to Arbitrary Menu Deletion
4.3
CVE-2024-12774
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Goodlayers Core <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11357
Jan 2, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
JSP Store Locator <= 1.0 - Cross-Site Request Forgery to Store Deletion
4.3
CVE-2024-12301
Dec 27, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Tabs Shortcode <= 2.0.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
6.4
CVE-2024-11606
Dec 17, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Tour Master - Tour Booking, Travel, Hotel < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking
7.2
CVE-2024-11356
Dec 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
AHAthat <= 1.6 - Reflected Cross-Site Scripting
6.1
CVE-2024-12595
Dec 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Tithe.ly Giving Button <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11841
Dec 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP-SVG <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-11644
Dec 6, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Float Block <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-11645
Dec 6, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
DN Shipping by Weight for WooCommerce <= 1.1.1 - Cross-Site Request Forgery to Plugin Settings Update
4.3
CVE-2024-11842
Dec 6, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Exhibit to WP Gallery <= 0.0.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-12096
Dec 3, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
WP MediaTagger <= 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-13101 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 10, 2025
Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-12722 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 10, 2025
WordPress连接微博 <= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-12282 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 7, 2025
Competition Form <= 2.0 - Cross-Site Request Forgery to Competition Deletion CVE-2024-12750 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 7, 2025
Social Share Buttons for WordPress <= 2.7 - Missing Authorization to Unauthenticated Image Upload & Path Traversal CVE-2024-13117 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 6, 2025
Social Share Buttons for WordPress <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-12807 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N January 6, 2025
Dyn Business Panel <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-13057 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 6, 2025
Dyn Business Panel <= 1.0.0 - Reflected Cross-Site Scripting CVE-2024-13056 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 6, 2025
WP Triggers Lite <= 2.5.3 - Authenticated (Admin+) SQL Injection CVE-2024-13095 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N January 6, 2025
Altra Side Menu <= 2.0 - Cross-Site Request Forgery to Arbitrary Menu Deletion CVE-2024-12774 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 6, 2025
Goodlayers Core <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11357 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 2, 2025
JSP Store Locator <= 1.0 - Cross-Site Request Forgery to Store Deletion CVE-2024-12301 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N December 27, 2024
Tabs Shortcode <= 2.0.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode CVE-2024-11606 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 17, 2024
Tour Master - Tour Booking, Travel, Hotel < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking CVE-2024-11356 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N December 16, 2024
AHAthat <= 1.6 - Reflected Cross-Site Scripting CVE-2024-12595 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N December 12, 2024
Tithe.ly Giving Button <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11841 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 9, 2024
WP-SVG <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-11644 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 6, 2024
Float Block <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-11645 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N December 6, 2024
DN Shipping by Weight for WooCommerce <= 1.1.1 - Cross-Site Request Forgery to Plugin Settings Update CVE-2024-11842 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N December 6, 2024
Exhibit to WP Gallery <= 0.0.2 - Reflected Cross-Site Scripting CVE-2024-12096 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N December 3, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation