Wordfence Intelligence   >   Vulnerability Researchers   >   Francesco Carlucci

Francesco Carlucci

8
All Time Ranking
253
All Time Discoveries

About

Hacker and Digital Nomad, the worst combination ever :)

9 Achievements

Learn more about Achievements
Submitted 200 Vulnerabilities
Submitted 200 Vulnerabilities
May 13, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
February 27, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
February 26, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
February 7, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
January 30, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
January 9, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 5, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
December 12, 2023
Submitted 1 Vulnerability
Submitted 1 Vulnerability
November 27, 2023
Learn more Learn more about Achievements

Showing 181-200 of 253 Vulnerabilities

WPKoi Templates for Elementor <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget
6.4
CVE-2024-2136
Mar 6, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-6880
Feb 29, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
6.4
CVE-2023-6809
Feb 27, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-6526
Feb 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-0254
Jan 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
GeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta
6.4
CVE-2023-6807
Jan 18, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
6.4
CVE-2023-6701
Jan 17, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data
6.4
CVE-2023-6982
Jan 16, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
6.4
CVE-2023-6938
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-6744
Dec 22, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-6225
Nov 27, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Add Custom Body Class <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-5205
Oct 20, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Display post meta, term meta, comment meta, and user meta <= 0.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-1661
May 30, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Get Custom Field Values <= 4.0.0 - Contributor+ Stored Cross-Site Scripting
6.4
CVE-2021-24871
Nov 9, 2021
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
About Author Box < 1.0.2 - Cross-Site Scripting
6.4
CVE-2021-24745
Oct 26, 2021
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Insert Pages <= 3.6.1 - Contributor+ Stored Cross-Site Scripting
6.4
CVE-2021-24850
Oct 18, 2021
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization
6.5
CVE-2024-1352
Apr 4, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode
6.5
CVE-2023-6695
Apr 3, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Redirects <= 1.2.1 - Missing Authorization via save
6.5
CVE-2024-1566
Feb 27, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service
6.5
CVE-2024-1108
Feb 20, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Title CVE ID CVSS Vector Date
WPKoi Templates for Elementor <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget CVE-2024-2136 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 6, 2024
Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-6880 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N February 29, 2024
Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode CVE-2023-6809 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N February 27, 2024
Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-6526 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N February 5, 2024
(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-0254 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 26, 2024
GeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta CVE-2023-6807 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 18, 2024
Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2023-6701 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 17, 2024
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data CVE-2023-6982 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 16, 2024
Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2023-6938 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 5, 2024
Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-6744 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 22, 2023
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-6225 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 27, 2023
Add Custom Body Class <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-5205 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 20, 2023
Display post meta, term meta, comment meta, and user meta <= 0.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting CVE-2023-1661 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 30, 2023
Get Custom Field Values <= 4.0.0 - Contributor+ Stored Cross-Site Scripting CVE-2021-24871 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 9, 2021
About Author Box < 1.0.2 - Cross-Site Scripting CVE-2021-24745 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 26, 2021
Insert Pages <= 3.6.1 - Contributor+ Stored Cross-Site Scripting CVE-2021-24850 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 18, 2021
Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization CVE-2024-1352 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N April 4, 2024
Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode CVE-2023-6695 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N April 3, 2024
Redirects <= 1.2.1 - Missing Authorization via save CVE-2024-1566 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L February 27, 2024
Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service CVE-2024-1108 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L February 20, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation