Wordfence Intelligence   >   Vulnerability Researchers   >   Abu Hurayra (HurayraIIT)

Abu Hurayra (HurayraIIT)

62
All Time Ranking
126
All Time Discoveries
2
90 Day Published Submissions
23 Jul '26
Last Published Submission

About

Lead Application Security Engineer with 4+ years of comprehensive experience in software quality assurance, security testing, and team leadership. Proven track record of securing applications serving 6+ million users globally while maintaining top-tier performance in WordPress security research.

4 Achievements

Learn more about Achievements
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
June 30, 2026
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
November 20, 2025
Submitted 1 Vulnerability
Submitted 1 Vulnerability
October 2, 2025
Submitted XSS Vulnerability
Submitted XSS Vulnerability
October 2, 2025
Learn more Learn more about Achievements

Showing 1-20 of 126 Vulnerabilities

Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
4.3
CVE-2026-12408
Jun 30, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure
4.3
CVE-2026-48877
May 27, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
X Addons for Elementor <= 1.0.23 - Missing Authorization
4.3
CVE-2026-24605
Jan 14, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Responsive Addons for Elementor <= 2.0.8 - Missing Authorization
4.3
CVE-2025-69363
Jan 12, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Testimonial Slider <= 2.0.15 - Missing Authorization
4.3
CVE-2025-68000
Dec 25, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2025-64295
Nov 26, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Blockspare <= 3.2.13.2 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2025-62026
Oct 16, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
4.3
CVE-2025-10732
Oct 13, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SEO Meta Description Updater <= 1.2.0 - Missing Authorization
4.3
CVE-2025-62928
Oct 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Nelio Content <= 4.0.5 - Missing Authorization
4.3
CVE-2025-62927
Oct 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Testimonial Slider <= 2.0.15 - Missing Authorization
4.3
CVE-2025-62929
Oct 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization
4.3
CVE-2025-66058
Oct 4, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization
4.3
CVE-2025-62924
Oct 4, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Stackable <= 3.18.1 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2025-60095
Sep 26, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
AR For WordPress <= 8.44 - Cross-Site Request Forgery
4.3
CVE-2025-60156
Sep 26, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Stackable <= 3.18.1 - Missing Authorization
4.3
CVE-2025-60094
Sep 26, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2025-58649
Sep 22, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
MaxiBlocks <= 2.1.3 - Missing Authorization
4.3
CVE-2025-58968
Sep 22, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Smart Blocks <= 2.4 - Missing Authorization
4.3
CVE-2025-59561
Sep 22, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Qubely <= 1.8.14 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2025-58249
Sep 22, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter CVE-2026-12408 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N June 30, 2026
GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure CVE-2026-48877 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N May 27, 2026
X Addons for Elementor <= 1.0.23 - Missing Authorization CVE-2026-24605 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 14, 2026
Responsive Addons for Elementor <= 2.0.8 - Missing Authorization CVE-2025-69363 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 12, 2026
Testimonial Slider <= 2.0.15 - Missing Authorization CVE-2025-68000 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N December 25, 2025
All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure CVE-2025-64295 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N November 26, 2025
Blockspare <= 3.2.13.2 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2025-62026 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N October 16, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure CVE-2025-10732 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N October 13, 2025
SEO Meta Description Updater <= 1.2.0 - Missing Authorization CVE-2025-62928 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 5, 2025
Nelio Content <= 4.0.5 - Missing Authorization CVE-2025-62927 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 5, 2025
Testimonial Slider <= 2.0.15 - Missing Authorization CVE-2025-62929 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 5, 2025
Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization CVE-2025-66058 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 4, 2025
Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization CVE-2025-62924 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 4, 2025
Stackable <= 3.18.1 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2025-60095 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N September 26, 2025
AR For WordPress <= 8.44 - Cross-Site Request Forgery CVE-2025-60156 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 26, 2025
Stackable <= 3.18.1 - Missing Authorization CVE-2025-60094 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 26, 2025
All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2025-58649 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N September 22, 2025
MaxiBlocks <= 2.1.3 - Missing Authorization CVE-2025-58968 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 22, 2025
Smart Blocks <= 2.4 - Missing Authorization CVE-2025-59561 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 22, 2025
Qubely <= 1.8.14 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2025-58249 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N September 22, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation