Wordfence Intelligence   >   Vulnerability Researchers   >   Dave Jong

Dave Jong

Organization: Patchstack

12
All Time Ranking
184
All Time Discoveries

Showing 41-60 of 184 Vulnerabilities

Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
8.8
CVE-2022-45077
Nov 17, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery
8.8
CVE-2022-41136
Oct 13, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery
8.8
CVE-2022-38086
Oct 2, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Avada <= 7.8.1 - Cross-Site Request Forgery
8.8
CVE-2022-41996
Sep 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP Reset PRO 5.00-5.98 - Cross-Site Request Forgery
8.8
CVE-2021-36908
Nov 10, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP Reset – Most Advanced WordPress Reset Tool (PRO) 5.00- 5.98 - Missing Authorization to Database Reset
8.8
CVE-2021-36909
Nov 10, 2021
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WatchTowerHQ <= 3.6.15 - Unauthenticated Arbitrary File Download
8.6
CVE-2022-44583
Nov 1, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Hide My WP <= 6.2.3 - SQL Injection
8.6
CVE-2021-36916
Nov 24, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CSSTidy - Server-Side Request Forgery
8.3
CVE-2022-40700
Mar 3, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
MainWP File Uploader Extension <= 4.1 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2023-23653
Jan 17, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure
7.5
CVE-2024-32086
Apr 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
PowerPack Pro for Elementor <= 2.10.6 - Missing Authorization to Settings Reset
7.5
CVE-2024-24844
Feb 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SalesKing <= 1.6.15 - Unauthenticated Sensitive Information Exposure
7.5
CVE-2024-22154
Jan 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium <= 1.1.0 - Sensitive Information Disclosure
7.5
CVE-2022-41623
Oct 12, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Hide My WP <= 6.2.3 - Authorization Bypass
7.5
CVE-2021-36917
Nov 24, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Wp Social <= 1.9.0 - Authenticated (Subscriber+) Information Disclosure
7.4
CVE-2022-47160
Dec 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
RealHomes <= 4.0.2 - Missing Authorization
7.3
CVE-2023-37885
Jul 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Zynith SEO <= 7.4.9 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-32562
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Types <= 3.4.17 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVE-2023-27440
Mar 3, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
MainWP Post Dripper Extension <= 4.0.4 - Missing Authorization to Arbitrary Page/Post Deletion
7.1
CVE-2023-23661
Jan 17, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Title CVE ID CVSS Vector Date
Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection CVE-2022-45077 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H November 17, 2022
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery CVE-2022-41136 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 13, 2022
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery CVE-2022-38086 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 2, 2022
Avada <= 7.8.1 - Cross-Site Request Forgery CVE-2022-41996 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 21, 2022
WP Reset PRO 5.00-5.98 - Cross-Site Request Forgery CVE-2021-36908 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 10, 2021
WP Reset – Most Advanced WordPress Reset Tool (PRO) 5.00- 5.98 - Missing Authorization to Database Reset CVE-2021-36909 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H November 10, 2021
WatchTowerHQ <= 3.6.15 - Unauthenticated Arbitrary File Download CVE-2022-44583 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N November 1, 2022
Hide My WP <= 6.2.3 - SQL Injection CVE-2021-36916 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L November 24, 2021
CSSTidy - Server-Side Request Forgery CVE-2022-40700 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L March 3, 2023
MainWP File Uploader Extension <= 4.1 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2023-23653 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H January 17, 2023
Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure CVE-2024-32086 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N April 11, 2024
PowerPack Pro for Elementor <= 2.10.6 - Missing Authorization to Settings Reset CVE-2024-24844 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N February 2, 2024
SalesKing <= 1.6.15 - Unauthenticated Sensitive Information Exposure CVE-2024-22154 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N January 16, 2024
ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium <= 1.1.0 - Sensitive Information Disclosure CVE-2022-41623 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N October 12, 2022
Hide My WP <= 6.2.3 - Authorization Bypass CVE-2021-36917 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H November 24, 2021
Wp Social <= 1.9.0 - Authenticated (Subscriber+) Information Disclosure CVE-2022-47160 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N December 14, 2022
RealHomes <= 4.0.2 - Missing Authorization CVE-2023-37885 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L July 11, 2023
Zynith SEO <= 7.4.9 - Unauthenticated Stored Cross-Site Scripting CVE-2024-32562 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N April 16, 2024
Types <= 3.4.17 - Authenticated (Administrator+) Arbitrary File Upload CVE-2023-27440 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H March 3, 2023
MainWP Post Dripper Extension <= 4.0.4 - Missing Authorization to Arbitrary Page/Post Deletion CVE-2023-23661 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L January 17, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation