Dave Jong

Vulnerabilities Discovered:

96
All Time Discoveries
11
Discoveries since Feb 27, 2023

Showing 1-20 of 96 vulnerabilities

Title CVE ID CVSS Vector Date
Resoto <= 1.0.8 - Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Plugin Activation CVE-2023-28619 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N March 22, 2023
Real Estate Directory <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation CVE-2023-28532 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 17, 2023
Chankhe <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation CVE-2023-28416 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 16, 2023
Mediciti Lite <= 1.3.0 - Reflected Cross-Site Scripting CVE-2023-28418 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 16, 2023
Intrepidity <= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin CVE-2023-27634 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H March 13, 2023
Regina Lite <= 2.0.7 - Reflected Cross-Site Scripting CVE-2023-27619 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N March 13, 2023
Brilliance <= 1.3.1 - Reflected Cross-Site Scripting CVE-2023-28171 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 13, 2023
Big Store <= 1.9.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation CVE-2023-27431 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N March 5, 2023
CSSTidy - Server-Side Request Forgery CVE-2022-40700 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L March 3, 2023
Types <= 3.4.17 - Authenticated (Administrator+) Arbitrary File Upload CVE-2023-27440 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H March 3, 2023
Total Theme <= 2.1.19 - Authenticated(Subscriber+) Plugin Activation CVE-2023-27456 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 1, 2023
Houzez <= 2.7.1 - Privilege Escalation CVE-2023-26540 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 27, 2023
Wholesale Suite <= 2.1.5 - Missing Authorization to Plugin Settings Change CVE-2022-34344 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 27, 2023
Zendrop – Global Dropshipping <= 1.0.0 - SQL Injection in setMetaData CVE-2023-25960 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 24, 2023
Zendrop – Global Dropshipping <= 1.0.0 - Arbitrary File Upload CVE-2023-25970 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 24, 2023
Houzez Login Register <= 2.6.3 - Privilege Escalation CVE-2023-26009 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 23, 2023
GamiPress <= 2.5.6 - Cross-Site Request Forgery to User Earnings Deletion CVE-2023-25697 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 14, 2023
WatchTowerHQ <= 3.6.16 - Type Juggling to Authentication Bypass in check_ota CVE-2023-25701 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 14, 2023
GamiPress <= 2.5.7 - Unauthenticated SQL Injection CVE-2023-24000 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 14, 2023
GamiPress <= 2.5.6 - Missing Authorization to User Points Updates CVE-2023-25715 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 13, 2023

Share this researcher's vulnerability discoveries

All the threat data shared in this database is powered by Wordfence Intelligence Enterprise.
Interested in integrating this data into your platform or network?
Contact us now to discuss API access to our Wordfence Intelligence Enterprise Data Feeds.

Inquire Now

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation