Wordfence Intelligence   >   Vulnerability Researchers   >   Dave Jong

Dave Jong

Organization: Patchstack

12
All Time Ranking
177
All Time Discoveries

Showing 1-20 of 177 Vulnerabilities

Post Type Builder <= 2.0.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-31365
Apr 9, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Post Type Builder <= 2.0.8 - Missing Authorization to Arbitrary Post/Page Creation
4.3
CVE-2024-31366
Apr 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated Arbitrary Email Sending
5.3
CVE-2024-31242
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion
5.3
CVE-2024-31243
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Update
5.3
CVE-2024-31244
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Demo My WordPress <= 1.0.9.1 - Unauthenticated Privilege Escalation
9.8
CVE-2024-31290
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Arbitrary Post Deletion
5.8
CVE-2024-31297
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Information Exposure
5.3
CVE-2024-30469
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
YITH WooCommerce Account Funds Premium <= 1.33.0 - Missing Authorization
4.3
CVE-2024-30470
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WooCommerce License Manager <= 5.3.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-29121
Mar 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WooThumbs for WooCommerce by Iconic <= 5.5.3 - Reflected Cross-Site Scripting
6.1
CVE-2024-29116
Mar 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Media folder <= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2024-25909
Feb 15, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WP Setup Wizard <= 1.0.8.1 - Authenticated (Subscriber+) Full Database Download
6.5
CVE-2024-25917
Feb 14, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
WooCommerce Easy Checkout Field Editor, Fees & Discounts <= 3.5.12 - Unauthenticated Arbitrary File Upload
9.8
CVE-2024-25925
Feb 14, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MoveTo <= 6.2 - Unauthenticated SQL Injection
9.8
CVE-2024-25910
Feb 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MoveTo <= 6.2 - Unauthenticated Arbitrary File Upload
9.8
CVE-2024-25913
Feb 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MoveTo <= 6.2 - Missing Authorization to Unauthenticated Options Update
9.8
CVE-2024-25912
Feb 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MoveTo <= 6.2 - Unauthenticated Directory Traversal to Arbitrary File Deletion
9.8
CVE-2024-25911
Feb 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WP Media folder <= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Plugin settings change
4.3
CVE-2024-25907
Feb 12, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Coupon Referral Program <= 1.7.2 - Unauthenticated PHP Object Injection
9.8
CVE-2024-25100
Feb 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
Post Type Builder <= 2.0.8 - Reflected Cross-Site Scripting CVE-2024-31365 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 9, 2024
Post Type Builder <= 2.0.8 - Missing Authorization to Arbitrary Post/Page Creation CVE-2024-31366 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N April 9, 2024
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated Arbitrary Email Sending CVE-2024-31242 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 5, 2024
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion CVE-2024-31243 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L April 5, 2024
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Update CVE-2024-31244 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 5, 2024
Demo My WordPress <= 1.0.9.1 - Unauthenticated Privilege Escalation CVE-2024-31290 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H April 5, 2024
Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Arbitrary Post Deletion CVE-2024-31297 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L April 5, 2024
Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Information Exposure CVE-2024-30469 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N March 28, 2024
YITH WooCommerce Account Funds Premium <= 1.33.0 - Missing Authorization CVE-2024-30470 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 28, 2024
WooCommerce License Manager <= 5.3.1 - Reflected Cross-Site Scripting CVE-2024-29121 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 16, 2024
WooThumbs for WooCommerce by Iconic <= 5.5.3 - Reflected Cross-Site Scripting CVE-2024-29116 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 16, 2024
WP Media folder <= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-25909 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 15, 2024
WP Setup Wizard <= 1.0.8.1 - Authenticated (Subscriber+) Full Database Download CVE-2024-25917 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N February 14, 2024
WooCommerce Easy Checkout Field Editor, Fees & Discounts <= 3.5.12 - Unauthenticated Arbitrary File Upload CVE-2024-25925 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 14, 2024
MoveTo <= 6.2 - Unauthenticated SQL Injection CVE-2024-25910 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 12, 2024
MoveTo <= 6.2 - Unauthenticated Arbitrary File Upload CVE-2024-25913 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 12, 2024
MoveTo <= 6.2 - Missing Authorization to Unauthenticated Options Update CVE-2024-25912 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 12, 2024
MoveTo <= 6.2 - Unauthenticated Directory Traversal to Arbitrary File Deletion CVE-2024-25911 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 12, 2024
WP Media folder <= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Plugin settings change CVE-2024-25907 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 12, 2024
Coupon Referral Program <= 1.7.2 - Unauthenticated PHP Object Injection CVE-2024-25100 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H February 5, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation