Wordfence Intelligence   >   Vulnerability Researchers   >   Abu Hurayra (HurayraIIT)

Abu Hurayra (HurayraIIT)

62
All Time Ranking
126
All Time Discoveries
2
90 Day Published Submissions
23 Jul '26
Last Published Submission

About

Lead Application Security Engineer with 4+ years of comprehensive experience in software quality assurance, security testing, and team leadership. Proven track record of securing applications serving 6+ million users globally while maintaining top-tier performance in WordPress security research.

4 Achievements

Learn more about Achievements
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
June 30, 2026
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
November 20, 2025
Submitted 1 Vulnerability
Submitted 1 Vulnerability
October 2, 2025
Submitted XSS Vulnerability
Submitted XSS Vulnerability
October 2, 2025
Learn more Learn more about Achievements

Showing 1-20 of 126 Vulnerabilities

King Addons for Elementor <= 51.1.36 - Unauthenticated Privilege Escalation
9.8
CVE-2025-6325
Oct 21, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation
8.8
CVE-2026-39579
Apr 16, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
MF Gig Calendar <=1.2.1 - Authenticated(Contributor+) SQL Injection
8.8
CVE-2023-50842
Dec 21, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Admin and Site Enhancements (ASE) <= 5.7.1 - Password Protection Mode Security Feature Bypass
7.5
CVE-2023-46630
Oct 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Store Locator WordPress <= 1.4.14 - Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion
6.6
CVE-2023-50885
Dec 26, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
AppMySite <= 3.15.0 - Missing Authorization
6.5
CVE-2025-58679
Sep 22, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
PowerPack Addons for Elementor <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-32430
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Magical Addons For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-32429
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-39703
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UiCore Elements <= 1.3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-39708
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-39702
Mar 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget
6.4
CVE-2025-12379
Jan 9, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
X Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-22518
Jan 7, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-11747
Dec 18, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget
6.4
CVE-2025-12965
Dec 11, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget
6.4
CVE-2025-12830
Dec 11, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-62082
Dec 7, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-63044
Dec 6, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-67951
Dec 6, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-66066
Dec 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
King Addons for Elementor <= 51.1.36 - Unauthenticated Privilege Escalation CVE-2025-6325 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H October 21, 2025
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation CVE-2026-39579 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H April 16, 2026
MF Gig Calendar <=1.2.1 - Authenticated(Contributor+) SQL Injection CVE-2023-50842 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H December 21, 2023
Admin and Site Enhancements (ASE) <= 5.7.1 - Password Protection Mode Security Feature Bypass CVE-2023-46630 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N October 25, 2023
Store Locator WordPress <= 1.4.14 - Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion CVE-2023-50885 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H December 26, 2023
AppMySite <= 3.15.0 - Missing Authorization CVE-2025-58679 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N September 22, 2025
PowerPack Addons for Elementor <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-32430 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
Magical Addons For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-32429 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-39703 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
UiCore Elements <= 1.3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-39708 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-39702 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 1, 2026
Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget CVE-2025-12379 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 9, 2026
X Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-22518 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 7, 2026
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-11747 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 18, 2025
Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget CVE-2025-12965 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 11, 2025
Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget CVE-2025-12830 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 11, 2025
Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-62082 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 7, 2025
Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-63044 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 6, 2025
WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-67951 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 6, 2025
Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-66066 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 5, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation