Wordfence Intelligence   >   Vulnerability Researchers   >   István Márton

István Márton

Organization: Wordfence

2
All Time Ranking
1004
All Time Discoveries
0
90 Day Published Submissions
26 Nov '25
Last Published Submission

About

I'm an experienced WordPress developer, with a focus on plugin development at Lana Solutions. I have spent years focusing on perfecting my skills as a developer, and have recently redirected efforts towards WordPress testing, audits, and vulnerability research. Currently, I'm a vulnerability research contractor for Wordfence and continue to defy the norms by maintaining status as the #1 Researcher in WordPress due to the volume of vulnerabilities I'm able to discover and responsibly disclose.

10 Achievements

Learn more about Achievements
Submitted LFI Vulnerability
Submitted LFI Vulnerability
September 30, 2025
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
September 8, 2025
Submitted SQLi Vulnerability
Submitted SQLi Vulnerability
July 30, 2025
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
August 5, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
June 26, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
April 19, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 17, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
November 27, 2023
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
November 9, 2023
Learn more Learn more about Achievements

Showing 1-20 of 1,004 Vulnerabilities

Tiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation
8.8
CVE-2025-13680
Nov 26, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login
9.8
CVE-2025-13539
Nov 26, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2025-11087
Nov 21, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
8.6
CVE-2025-10897
Oct 30, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Felan Framework <= 1.1.4 - Hardcoded Credentials
9.8
CVE-2025-10850
Oct 15, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
5.3
CVE-2025-10849
Oct 15, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change
9.8
CVE-2025-10742
Oct 15, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
8.8
CVE-2025-10706
Oct 15, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-9061
Sep 8, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-9058
Sep 8, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change
9.8
CVE-2025-9114
Sep 8, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload
9.8
CVE-2025-9113
Sep 8, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2025-9112
Sep 8, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Biagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-9057
Sep 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
8.8
CVE-2025-4796
Aug 8, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
5.5
CVE-2025-7387
Jul 9, 2025
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
AI Engine 2.8.4 - Insecure OAuth Implementation
8.0
CVE-2025-6238
Jul 3, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP
8.8
CVE-2025-5071
Jun 18, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete
4.3
CVE-2025-1778
Jun 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save
6.4
CVE-2025-1777
Jun 5, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Tiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation CVE-2025-13680 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H November 26, 2025
FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login CVE-2025-13539 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H November 26, 2025
Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2025-11087 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 21, 2025
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read CVE-2025-10897 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N October 30, 2025
Felan Framework <= 1.1.4 - Hardcoded Credentials CVE-2025-10850 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H October 15, 2025
Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions CVE-2025-10849 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N October 15, 2025
Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change CVE-2025-10742 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H October 15, 2025
Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation CVE-2025-10706 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H October 15, 2025
Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-9061 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N September 8, 2025
Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-9058 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N September 8, 2025
Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change CVE-2025-9114 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H September 8, 2025
Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload CVE-2025-9113 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H September 8, 2025
Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2025-9112 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H September 8, 2025
Biagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-9057 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N September 5, 2025
Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover CVE-2025-4796 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H August 8, 2025
Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-7387 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N July 9, 2025
AI Engine 2.8.4 - Insecure OAuth Implementation CVE-2025-6238 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H July 3, 2025
AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP CVE-2025-5071 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H June 18, 2025
Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete CVE-2025-1778 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N June 5, 2025
BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save CVE-2025-1777 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 5, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation