🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers, top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > emad

emad

All Time Ranking

All Time Discoveries

90 Day Published Submissions

24 Sep '24

Last Published Submission

3 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 1-20 of 68 Vulnerabilities

Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing

7.5

CVE-2024-5598

Jun 28, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing

7.5

CVE-2024-5599

Jun 6, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Everest Backup <= 2.2.4 - Authenticated (Admin+) Arbitrary File Upload

7.2

CVE-2023-7201

Mar 25, 2024

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CformsII <= 15.0.5 - Unauthenticated stored Cross-Site Scripting

7.2

CVE-2024-22149

Jan 15, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

weForms <= 1.6.18 - Missing Authorization via export_form_entries

6.5

CVE-2023-51524

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-3666

May 21, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via force_fit

6.4

CVE-2024-29807

Mar 25, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

HashBar – WordPress Notification Bar <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2023-51372

Dec 26, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Guest Author <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2023-49747

Dec 4, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Responsive Lightbox <= 2.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via name

6.4

CVE-2023-49174

Nov 29, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Parallax Slider Block <= 1.2.5 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2023-49184

Nov 29, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

ARI Stream Quiz <= 1.2.32 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-47835

Nov 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Quiz And Survey Master <= 8.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-47834

Nov 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Brizy <= 2.4.29 - Cross-Site Scripting

6.4

CVE-2023-51396

Nov 6, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Mediabay <= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting Vulnerability

6.4

CVE-2023-46066

Oct 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Tutor LMS <= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVE-2023-4805

Sep 25, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

PowerPress <= 11.0.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL

6.4

CVE-2023-4820

Sep 13, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Absolutely Glamorous Custom Admin <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery

5.5

CVE-2024-33627

Apr 24, 2024

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options

5.5

CVE-2024-0659

Feb 2, 2024

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

WP Event Manager <= 3.1.41 - Authenticated (Editor+) Stored Cross-Site Scripting

5.5

CVE-2023-49181

Nov 29, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing	CVE-2024-5598	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	June 28, 2024
FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing	CVE-2024-5599	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	June 6, 2024
Everest Backup <= 2.2.4 - Authenticated (Admin+) Arbitrary File Upload	CVE-2023-7201	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	March 25, 2024
CformsII <= 15.0.5 - Unauthenticated stored Cross-Site Scripting	CVE-2024-22149	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	January 15, 2024
weForms <= 1.6.18 - Missing Authorization via export_form_entries	CVE-2023-51524	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	December 27, 2023
Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-3666	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 21, 2024
DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via force_fit	CVE-2024-29807	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	March 25, 2024
HashBar – WordPress Notification Bar <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting	CVE-2023-51372	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	December 26, 2023
Guest Author <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting	CVE-2023-49747	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	December 4, 2023
Responsive Lightbox <= 2.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via name	CVE-2023-49174	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 29, 2023
Parallax Slider Block <= 1.2.5 - Authenticated (Author+) Stored Cross-Site Scripting	CVE-2023-49184	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 29, 2023
ARI Stream Quiz <= 1.2.32 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-47835	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 16, 2023
Quiz And Survey Master <= 8.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-47834	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 16, 2023
Brizy <= 2.4.29 - Cross-Site Scripting	CVE-2023-51396	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 6, 2023
Mediabay <= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting Vulnerability	CVE-2023-46066	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	October 16, 2023
Tutor LMS <= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting	CVE-2023-4805	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	September 25, 2023
PowerPress <= 11.0.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL	CVE-2023-4820	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	September 13, 2023
Absolutely Glamorous Custom Admin <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery	CVE-2024-33627	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	April 24, 2024
Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options	CVE-2024-0659	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	February 2, 2024
WP Event Manager <= 3.1.41 - Authenticated (Editor+) Stored Cross-Site Scripting	CVE-2023-49181	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	November 29, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation