Wordfence Intelligence   >   Vulnerability Researchers   >   Joshua Chan

Joshua Chan

26
All Time Ranking
162
All Time Discoveries
4
90 Day Published Submissions
6 Jan '25
Last Published Submission

About

Penetration Tester, Security Researcher

2 Achievements

Learn more about Achievements
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 6, 2025
Submitted 1 Vulnerability
Submitted 1 Vulnerability
October 9, 2024
Learn more Learn more about Achievements

Showing 1-20 of 162 Vulnerabilities

Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure
5.3
CVE-2024-12159
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-22295
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure
5.3
CVE-2024-12250
Dec 17, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files
7.2
CVE-2024-9698
Dec 13, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
WP-NERD Toolkit <= 1.1 - Unauthenticated Information Exposure
5.3
CVE-2024-54279
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure
5.3
CVE-2024-12255
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Import Export For WooCommerce <= 1.5 - Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-54262
Dec 6, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Content Audit Exporter <= 1.1 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-53768
Nov 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Advanced What should we write next about <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
4.3
CVE-2024-53789
Nov 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Multi Feed Reader <= 2.2.4 - Cross-Site Request Forgery
4.3
CVE-2024-53718
Nov 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Hacklog DownloadManager <= 2.1.4 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2024-52401
Nov 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2024-52402
Nov 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CDI <= 5.5.3 - Authenticated (Shop Manager+) Arbitrary File Upload
7.2
CVE-2024-52398
Nov 13, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SV Forms <= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-51877
Nov 8, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-51819
Nov 8, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
MyCurator Content Curation <= 3.78 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-51668
Nov 1, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
GMO Social Connection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-51636
Nov 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Admin SMS Alert<=1.1.0 - Cross-Site Request Forgery to Stored Cross Site Scripting
6.1
CVE-2024-51637
Nov 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2024-49674
Oct 21, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Schema & Structured Data for WP & AMP <= 1.35 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-49683
Oct 21, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure CVE-2024-12159 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N January 6, 2025
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.6 - Unauthenticated Stored Cross-Site Scripting CVE-2025-22295 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N January 6, 2025
Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure CVE-2024-12250 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 17, 2024
Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files CVE-2024-9698 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H December 13, 2024
WP-NERD Toolkit <= 1.1 - Unauthenticated Information Exposure CVE-2024-54279 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 11, 2024
Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure CVE-2024-12255 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 11, 2024
Import Export For WooCommerce <= 1.5 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-54262 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H December 6, 2024
Content Audit Exporter <= 1.1 - Unauthenticated Sensitive Information Exposure CVE-2024-53768 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 28, 2024
Advanced What should we write next about <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-53789 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N November 28, 2024
Multi Feed Reader <= 2.2.4 - Cross-Site Request Forgery CVE-2024-53718 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N November 22, 2024
Hacklog DownloadManager <= 2.1.4 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2024-52401 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 13, 2024
Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2024-52402 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 13, 2024
CDI <= 5.5.3 - Authenticated (Shop Manager+) Arbitrary File Upload CVE-2024-52398 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H November 13, 2024
SV Forms <= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-51877 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 8, 2024
Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-51819 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 8, 2024
MyCurator Content Curation <= 3.78 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-51668 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N November 1, 2024
GMO Social Connection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-51636 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N November 1, 2024
Admin SMS Alert<=1.1.0 - Cross-Site Request Forgery to Stored Cross Site Scripting CVE-2024-51637 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N November 1, 2024
EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2024-49674 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 21, 2024
Schema & Structured Data for WP & AMP <= 1.35 - Unauthenticated Sensitive Information Exposure CVE-2024-49683 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N October 21, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation