Wordfence Intelligence   >   Vulnerability Researchers   >   Dave Jong

Dave Jong

Organization: Patchstack

11
All Time Ranking
201
All Time Discoveries

Showing 141-160 of 201 Vulnerabilities

Wp Social <= 1.9.0 - Authenticated (Subscriber+) Information Disclosure
7.4
CVE-2022-47160
Dec 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure
7.5
CVE-2024-32086
Apr 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
PowerPack Pro for Elementor <= 2.10.6 - Missing Authorization to Settings Reset
7.5
CVE-2024-24844
Feb 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SalesKing <= 1.6.15 - Unauthenticated Sensitive Information Exposure
7.5
CVE-2024-22154
Jan 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium <= 1.1.0 - Sensitive Information Disclosure
7.5
CVE-2022-41623
Oct 12, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Hide My WP <= 6.2.3 - Authorization Bypass
7.5
CVE-2021-36917
Nov 24, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ARForms <= 6.4 - Missing Authorization to Arbitrary File Deletion
8.1
CVE-2024-32703
Apr 22, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
MainWP File Uploader Extension <= 4.1 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2023-23653
Jan 17, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CSSTidy - Server-Side Request Forgery
8.3
CVE-2022-40700
Mar 3, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
WatchTowerHQ <= 3.6.15 - Unauthenticated Arbitrary File Download
8.6
CVE-2022-44583
Nov 1, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Hide My WP <= 6.2.3 - SQL Injection
8.6
CVE-2021-36916
Nov 24, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
XforWooCommerce <= 2.0.2 - Authenticated (Subscriber+) Local File Inclusion
8.8
CVE-2024-33628
Apr 25, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ARforms <= 6.4 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2024-32706
Apr 22, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Hercules Core <= 6.4 - Authenticated (Subscriber+) PHP Object Injection
8.8
CVE-2024-30228
Mar 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WP Media folder <= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2024-25909
Feb 15, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Profile Builder Pro <= 3.10.0 - Cross-Site Request Forgery
8.8
CVE-2024-22140
Jan 10, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Houzez CRM <= 1.3.4 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2023-36529
Jun 27, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CM Pop-Up banners <= 1.5.10 - Authenticated (Subscriber+) SQL Injection via getStatistics
8.8
CVE-2023-30750
May 3, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Intrepidity <= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin
8.8
CVE-2023-27634
Mar 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Corsa Theme <= 1.5 - Authenticated Arbitrary File Upload
8.8
CVE-2023-23970
Jan 23, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
Wp Social <= 1.9.0 - Authenticated (Subscriber+) Information Disclosure CVE-2022-47160 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N December 14, 2022
Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure CVE-2024-32086 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N April 11, 2024
PowerPack Pro for Elementor <= 2.10.6 - Missing Authorization to Settings Reset CVE-2024-24844 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N February 2, 2024
SalesKing <= 1.6.15 - Unauthenticated Sensitive Information Exposure CVE-2024-22154 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N January 16, 2024
ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium <= 1.1.0 - Sensitive Information Disclosure CVE-2022-41623 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N October 12, 2022
Hide My WP <= 6.2.3 - Authorization Bypass CVE-2021-36917 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H November 24, 2021
ARForms <= 6.4 - Missing Authorization to Arbitrary File Deletion CVE-2024-32703 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H April 22, 2024
MainWP File Uploader Extension <= 4.1 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2023-23653 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H January 17, 2023
CSSTidy - Server-Side Request Forgery CVE-2022-40700 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L March 3, 2023
WatchTowerHQ <= 3.6.15 - Unauthenticated Arbitrary File Download CVE-2022-44583 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N November 1, 2022
Hide My WP <= 6.2.3 - SQL Injection CVE-2021-36916 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L November 24, 2021
XforWooCommerce <= 2.0.2 - Authenticated (Subscriber+) Local File Inclusion CVE-2024-33628 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H April 25, 2024
ARforms <= 6.4 - Authenticated (Subscriber+) SQL Injection CVE-2024-32706 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H April 22, 2024
Hercules Core <= 6.4 - Authenticated (Subscriber+) PHP Object Injection CVE-2024-30228 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H March 26, 2024
WP Media folder <= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-25909 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 15, 2024
Profile Builder Pro <= 3.10.0 - Cross-Site Request Forgery CVE-2024-22140 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H January 10, 2024
Houzez CRM <= 1.3.4 - Authenticated (Subscriber+) SQL Injection CVE-2023-36529 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H June 27, 2023
CM Pop-Up banners <= 1.5.10 - Authenticated (Subscriber+) SQL Injection via getStatistics CVE-2023-30750 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H May 3, 2023
Intrepidity <= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin CVE-2023-27634 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H March 13, 2023
Corsa Theme <= 1.5 - Authenticated Arbitrary File Upload CVE-2023-23970 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 23, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation