Wordfence Intelligence   >   Vulnerability Researchers   >   Abu Hurayra (HurayraIIT)

Abu Hurayra (HurayraIIT)

61
All Time Ranking
125
All Time Discoveries
1
90 Day Published Submissions
30 Jun '26
Last Published Submission

About

Lead Application Security Engineer with 4+ years of comprehensive experience in software quality assurance, security testing, and team leadership. Proven track record of securing applications serving 6+ million users globally while maintaining top-tier performance in WordPress security research.

4 Achievements

Learn more about Achievements
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
June 30, 2026
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
November 20, 2025
Submitted 1 Vulnerability
Submitted 1 Vulnerability
October 2, 2025
Submitted XSS Vulnerability
Submitted XSS Vulnerability
October 2, 2025
Learn more Learn more about Achievements

Showing 1-20 of 125 Vulnerabilities

Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
4.3
CVE-2026-12408
Jun 30, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure
4.3
CVE-2026-48877
May 27, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation
8.8
CVE-2026-39579
Apr 16, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Magical Addons For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-32429
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UiCore Elements <= 1.3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-39708
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-39703
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-39702
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PowerPack Addons for Elementor <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-32430
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
X Addons for Elementor <= 1.0.23 - Missing Authorization
4.3
CVE-2026-24605
Jan 14, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Responsive Addons for Elementor <= 2.0.8 - Missing Authorization
4.3
CVE-2025-69363
Jan 12, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget
6.4
CVE-2025-12379
Jan 9, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
X Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-22518
Jan 7, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Testimonial Slider <= 2.0.15 - Missing Authorization
4.3
CVE-2025-68000
Dec 25, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-11747
Dec 18, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget
6.4
CVE-2025-12965
Dec 11, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget
6.4
CVE-2025-12830
Dec 11, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-62082
Dec 7, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-63044
Dec 6, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-67951
Dec 6, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-66066
Dec 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter CVE-2026-12408 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N June 30, 2026
GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure CVE-2026-48877 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N May 27, 2026
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation CVE-2026-39579 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H April 16, 2026
Magical Addons For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-32429 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
UiCore Elements <= 1.3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-39708 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-39703 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-39702 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
PowerPack Addons for Elementor <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-32430 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
X Addons for Elementor <= 1.0.23 - Missing Authorization CVE-2026-24605 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 14, 2026
Responsive Addons for Elementor <= 2.0.8 - Missing Authorization CVE-2025-69363 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 12, 2026
Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget CVE-2025-12379 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 9, 2026
X Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-22518 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 7, 2026
Testimonial Slider <= 2.0.15 - Missing Authorization CVE-2025-68000 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N December 25, 2025
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-11747 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 18, 2025
Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget CVE-2025-12965 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 11, 2025
Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget CVE-2025-12830 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 11, 2025
Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-62082 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 7, 2025
Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-63044 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 6, 2025
WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-67951 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 6, 2025
Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-66066 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 5, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation