Wordfence Intelligence   >   Vulnerability Researchers   >   Brandon James Roldan (tomorrowisnew)

Brandon James Roldan (tomorrowisnew)

43
All Time Ranking
80
All Time Discoveries

Showing 1-20 of 80 Vulnerabilities

Formcraft3 <= 3.8.27 - Server Side Request Forgery
9.1
CVE-2022-0591
Feb 28, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
wpForo Forum <= 2.0.5 - Cross-Site Request Forgery
8.8
CVE-2022-38144
Sep 8, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
wpForo Forum <= 2.0.5 - Cross-Site Request Forgery
8.8
CVE-2022-40632
Sep 8, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AnyComment <= 0.2.17 - Cross-Site Request Forgery
8.8
CVE-2022-0134
Jan 19, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Better Messages <= 1.9.9.148 - Cross-Site Request Forgery
8.8
CVE-2022-29454
Jan 18, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
BP Better Messages <= 1.9.9.37 - Cross-Site Request Forgery
8.8
CVE-2021-24809
Oct 4, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 8.8.13 - Server Side Request Forgery
8.1
CVE-2022-1239
Apr 11, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Support Board < 3.3.6 - Cross-Site Request Forgery
8.1
CVE-2021-24823
Oct 18, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
MultiSafepay plugin for WooCommerce <= 4.15.0 - Arbitrary File Read
7.5
CVE-2022-33901
Jul 18, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion
7.5
CVE-2021-24839
Jan 5, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Tab – Accordion, FAQ < 1.3.2 - Unauthenticated Arbitrary Tab Modification
7.5
CVE-2021-24831
Dec 6, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
MapSVG <= 6.2.19 - SQL Injection
7.3
CVE-2022-0592
Apr 18, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2022-0595
Mar 7, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Plezi < 1.0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2022-0680
Mar 7, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Profile Builder <= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php
7.1
CVE-2023-47669
Nov 7, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Affiliates Manager <= 2.9.31 - Cross-Site Request Forgery via multiple AJAX actions
6.5
CVE-2023-52130
Dec 28, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Activello <= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2022-45849
Nov 23, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Activello <= 1.4.4 - Reflected Cross-Site Scripting
6.4
CVE-2022-45358
Nov 23, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP Google Analytics Events <= 2.8.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-32145
Apr 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Contact Form 7 – PayPal & Stripe Add-on <= 2.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-29130
Mar 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Formcraft3 <= 3.8.27 - Server Side Request Forgery CVE-2022-0591 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N February 28, 2022
wpForo Forum <= 2.0.5 - Cross-Site Request Forgery CVE-2022-38144 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 8, 2022
wpForo Forum <= 2.0.5 - Cross-Site Request Forgery CVE-2022-40632 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 8, 2022
AnyComment <= 0.2.17 - Cross-Site Request Forgery CVE-2022-0134 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H January 19, 2022
Better Messages <= 1.9.9.148 - Cross-Site Request Forgery CVE-2022-29454 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H January 18, 2022
BP Better Messages <= 1.9.9.37 - Cross-Site Request Forgery CVE-2021-24809 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 4, 2021
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 8.8.13 - Server Side Request Forgery CVE-2022-1239 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N April 11, 2022
Support Board < 3.3.6 - Cross-Site Request Forgery CVE-2021-24823 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H October 18, 2021
MultiSafepay plugin for WooCommerce <= 4.15.0 - Arbitrary File Read CVE-2022-33901 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N July 18, 2022
SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion CVE-2021-24839 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N January 5, 2022
Tab – Accordion, FAQ < 1.3.2 - Unauthenticated Arbitrary Tab Modification CVE-2021-24831 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N December 6, 2021
MapSVG <= 6.2.19 - SQL Injection CVE-2022-0592 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L April 18, 2022
Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting CVE-2022-0595 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N March 7, 2022
Plezi < 1.0.3 - Unauthenticated Stored Cross-Site Scripting CVE-2022-0680 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N March 7, 2022
Profile Builder <= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php CVE-2023-47669 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L November 7, 2023
Affiliates Manager <= 2.9.31 - Cross-Site Request Forgery via multiple AJAX actions CVE-2023-52130 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N December 28, 2023
Activello <= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2022-45849 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 23, 2022
Activello <= 1.4.4 - Reflected Cross-Site Scripting CVE-2022-45358 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 23, 2022
WP Google Analytics Events <= 2.8.0 - Reflected Cross-Site Scripting CVE-2024-32145 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 12, 2024
Contact Form 7 – PayPal & Stripe Add-on <= 2.0 - Reflected Cross-Site Scripting CVE-2024-29130 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 16, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation