🔎 Have you found a vulnerability in a WordPress plugin or theme? Report vulnerabilities in WordPress plugins and themes through our bug bounty program and earn a bounty on all in-scope submissions, while we handle the responsible disclosure process on your behalf.

Wordfence Intelligence > Vulnerability Researchers > João G. Barbosa (4rCanJ0x!)

João G. Barbosa (4rCanJ0x!)

110

All Time Ranking

All Time Discoveries

2 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 1-20 of 24 Vulnerabilities

WordPress Team Manager <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion

8.8

CVE-2024-38704

Jul 11, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

GutSlider – All in One Block Slider <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-37955

Jul 10, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SKT Addons for Elementor <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-38674

Jul 10, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 5.3.1 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2024-38686

Jul 10, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-37519

Jul 5, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-37428

Jun 28, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Kenta Blocks – Responsive Blocks and block templates library <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVE-2024-35731

Jun 6, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags

6.4

CVE-2024-2922

Jun 5, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags

6.4

CVE-2024-3066

May 21, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Post Grid Elementor Addon <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag

6.4

CVE-2024-34789

May 17, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Elegant Blocks <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-34769

May 17, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-3134

May 16, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Visual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameter

6.4

CVE-2024-4363

May 14, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

DethemeKit For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-34575

May 14, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Magazine Blocks <= 1.3.6 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2024-34760

May 14, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-35167

May 10, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

All Bootstrap Blocks <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-35169

May 10, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block

6.4

CVE-2024-34436

May 7, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Better Elementor Addons <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-34432

May 7, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Thim Elementor Kit <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-34415

May 6, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
WordPress Team Manager <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion	CVE-2024-38704	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	July 11, 2024
GutSlider – All in One Block Slider <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-37955	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 10, 2024
SKT Addons for Elementor <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-38674	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 10, 2024
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 5.3.1 - Authenticated (Author+) Stored Cross-Site Scripting	CVE-2024-38686	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 10, 2024
Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-37519	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 5, 2024
WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-37428	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 28, 2024
Kenta Blocks – Responsive Blocks and block templates library <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35731	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	June 6, 2024
Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags	CVE-2024-2922	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 5, 2024
Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags	CVE-2024-3066	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 21, 2024
Post Grid Elementor Addon <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag	CVE-2024-34789	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 17, 2024
Elegant Blocks <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-34769	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 17, 2024
Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-3134	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 16, 2024
Visual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameter	CVE-2024-4363	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 14, 2024
DethemeKit For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-34575	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 14, 2024
Magazine Blocks <= 1.3.6 - Authenticated (Author+) Stored Cross-Site Scripting	CVE-2024-34760	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 14, 2024
Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35167	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 10, 2024
All Bootstrap Blocks <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35169	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 10, 2024
SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block	CVE-2024-34436	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 7, 2024
Better Elementor Addons <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-34432	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 7, 2024
Thim Elementor Kit <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-34415	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 6, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation