Wordfence Intelligence   >   Vulnerability Researchers   >   Bob Matyas

Bob Matyas

36
All Time Ranking
88
All Time Discoveries

Showing 1-20 of 88 Vulnerabilities

KKProgressbar2 Free <= 1.1.4.2 - Authenticated (Admin+) SQL Injection
9.1
CVE-2024-4533
May 6, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection
9.1
CVE-2024-3060
Apr 26, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
KKProgressbar2 Free <= 1.1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
7.2
CVE-2024-4534
May 6, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Simple Buttons Creator <=1.04 - Unauthenticated Stored Cross-Site Scripting via Add Button
7.2
CVE-2024-2857
Mar 25, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
illi Link Party! <= 1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2023-7228
Jan 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
MM-email2image <= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-3075
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Scalable Vector Graphics (SVG) <= 3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
6.4
CVE-2023-7085
Feb 20, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Allow SVG <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
6.4
CVE-2023-6541
Jan 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
SVG Uploads Support <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
6.4
CVE-2023-7086
Jan 23, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
6.4
CVE-2023-7088
Jan 23, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Easy SVG Allow <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
6.4
CVE-2023-7089
Jan 3, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CITS Support svg, webp Media and TTF,OTF File Upload <= 2.1.0 - Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload
6.4
CVE-2023-5458
Oct 9, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Pet Manager <= 1.4 - Reflected Cross-Site Scripting
6.1
CVE-2024-3917
May 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Sailthru Triggermail <= 1.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-4289
Apr 30, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fancy Product Designer <= 6.1.7 - Reflected Cross-Site Scripting
6.1
CVE-2024-0905
Apr 26, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-3823
Apr 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-3941
Apr 19, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Add Custom CSS and JS <= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-3903
Apr 18, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WPB Show Core <= 2.6 - Reflected Cross-Site Scripting via 'file'
6.1
CVE-2024-1958
Apr 18, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
UnGallery <= 2.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-3582
Apr 18, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
KKProgressbar2 Free <= 1.1.4.2 - Authenticated (Admin+) SQL Injection CVE-2024-4533 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H May 6, 2024
ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection CVE-2024-3060 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H April 26, 2024
KKProgressbar2 Free <= 1.1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-4534 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N May 6, 2024
Simple Buttons Creator <=1.04 - Unauthenticated Stored Cross-Site Scripting via Add Button CVE-2024-2857 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N March 25, 2024
illi Link Party! <= 1.0 - Unauthenticated Stored Cross-Site Scripting CVE-2023-7228 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N January 23, 2024
MM-email2image <= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-3075 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 5, 2024
Scalable Vector Graphics (SVG) <= 3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2023-7085 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N February 20, 2024
Allow SVG <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2023-6541 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 26, 2024
SVG Uploads Support <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2023-7086 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 23, 2024
Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2023-7088 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 23, 2024
Easy SVG Allow <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2023-7089 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 3, 2024
CITS Support svg, webp Media and TTF,OTF File Upload <= 2.1.0 - Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload CVE-2023-5458 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 9, 2023
Pet Manager <= 1.4 - Reflected Cross-Site Scripting CVE-2024-3917 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N May 2, 2024
Sailthru Triggermail <= 1.1 - Reflected Cross-Site Scripting CVE-2024-4289 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 30, 2024
Fancy Product Designer <= 6.1.7 - Reflected Cross-Site Scripting CVE-2024-0905 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 26, 2024
Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-3823 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 24, 2024
reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-3941 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 19, 2024
Add Custom CSS and JS <= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-3903 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 18, 2024
WPB Show Core <= 2.6 - Reflected Cross-Site Scripting via 'file' CVE-2024-1958 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 18, 2024
UnGallery <= 2.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-3582 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 18, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation