Wordfence Intelligence   >   Vulnerability Researchers   >   István Márton

István Márton

Organization: Wordfence

1
All Time Ranking
803
All Time Discoveries

About

I'm an experienced WordPress developer, with a focus on plugin development at Lana Solutions. I have spent years focusing on perfecting my skills as a developer, and have recently redirected efforts towards WordPress testing, audits, and vulnerability research. Currently, I'm a vulnerability research contractor for Wordfence and continue to defy the norms by maintaining status as the #1 Researcher in WordPress due to the volume of vulnerabilities I'm able to discover and responsibly disclose.

4 Achievements

Learn more about Achievements
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
April 19, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 17, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
November 27, 2023
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
November 9, 2023
Learn more Learn more about Achievements

Showing 81-100 of 803 Vulnerabilities

WP Yelp Review Slider <= 7.0 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2023-0263
Jan 23, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WP Airbnb Review Slider <= 3.2 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2023-0262
Jan 23, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WP Review Slider <= 12.1 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2023-0260
Jan 23, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WP Google Review Slider <= 11.7 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2023-0259
Jan 23, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Dashicons + Custom Post Types <= 1.0.2 - Missing Authorization
8.8
CVE-2023-22674
Jan 13, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Crayon Syntax Highlighter <= 2.8.4 - Cross-Site Request Forgery
8.8
CVE-2022-47167
Jan 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP Mail Log <= 1.0.1 - Cross-Site Request Forgery
8.8
CVE-2022-45807
Dec 2, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Sunshine Photo Cart <= 2.9.13 - Cross-Site Request Forgery
8.8
CVE-2022-40692
Dec 2, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP OAuth Server (OAuth Authentication) <= 4.2.5 - Cross-Site Request Forgery
8.8
CVE-2022-3926
Nov 10, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WordPress REST API Authentication <= 2.4.0 - Cross-Site Request Forgery
8.8
CVE-2022-45073
Nov 9, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OAuth Client by DigitialPixies <= 1.1.0 - Cross-Site Request Forgery
8.8
CVE-2022-3632
Oct 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Csomagpontok és szállítási címkék WooCommerce hez <= 1.9.0.2 - Cross-Site Request Forgery
8.8
CVE-2022-41685
Oct 20, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Integration for Szamlazz.hu & WooCommerce <= 5.6.3.2 - Cross-Site Request Forgery
8.8
CVE-2022-41685
Oct 20, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Advanced Order Export For WooCommerce <= 3.3.2 - Cross-Site Request Forgery
8.8
CVE-2022-40128
Oct 20, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Backup Scheduler <= 1.5.13 - Cross-Site Request Forgery
8.8
CVE-2022-38079
Sep 23, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
3D Tag Cloud <= 3.8 - Cross-Site Request Forgery
8.8
CVE-2022-36417
Sep 22, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP Custom Cursors <= 3.0 - Cross-Site Request Forgery to Cursor Manipulation
8.8
CVE-2022-3151
Sep 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
FavIcon Switcher <= 1.2.11 - Cross-Site Request Forgery
8.8
CVE-2022-40219
Sep 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Multiple Plugins from Viszt Peter - Cross-Site Request Forgery
8.8
CVE-2022-3154
Sep 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Bitcoin / Altcoin Faucet <= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
8.8
CVE-2022-3025
Aug 31, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
WP Yelp Review Slider <= 7.0 - Authenticated (Subscriber+) SQL Injection CVE-2023-0263 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 23, 2023
WP Airbnb Review Slider <= 3.2 - Authenticated (Subscriber+) SQL Injection CVE-2023-0262 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 23, 2023
WP Review Slider <= 12.1 - Authenticated (Subscriber+) SQL Injection CVE-2023-0260 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 23, 2023
WP Google Review Slider <= 11.7 - Authenticated (Subscriber+) SQL Injection CVE-2023-0259 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 23, 2023
Dashicons + Custom Post Types <= 1.0.2 - Missing Authorization CVE-2023-22674 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 13, 2023
Crayon Syntax Highlighter <= 2.8.4 - Cross-Site Request Forgery CVE-2022-47167 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H January 13, 2023
WP Mail Log <= 1.0.1 - Cross-Site Request Forgery CVE-2022-45807 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H December 2, 2022
Sunshine Photo Cart <= 2.9.13 - Cross-Site Request Forgery CVE-2022-40692 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H December 2, 2022
WP OAuth Server (OAuth Authentication) <= 4.2.5 - Cross-Site Request Forgery CVE-2022-3926 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 10, 2022
WordPress REST API Authentication <= 2.4.0 - Cross-Site Request Forgery CVE-2022-45073 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 9, 2022
OAuth Client by DigitialPixies <= 1.1.0 - Cross-Site Request Forgery CVE-2022-3632 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 21, 2022
Csomagpontok és szállítási címkék WooCommerce hez <= 1.9.0.2 - Cross-Site Request Forgery CVE-2022-41685 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 20, 2022
Integration for Szamlazz.hu & WooCommerce <= 5.6.3.2 - Cross-Site Request Forgery CVE-2022-41685 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 20, 2022
Advanced Order Export For WooCommerce <= 3.3.2 - Cross-Site Request Forgery CVE-2022-40128 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 20, 2022
Backup Scheduler <= 1.5.13 - Cross-Site Request Forgery CVE-2022-38079 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 23, 2022
3D Tag Cloud <= 3.8 - Cross-Site Request Forgery CVE-2022-36417 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 22, 2022
WP Custom Cursors <= 3.0 - Cross-Site Request Forgery to Cursor Manipulation CVE-2022-3151 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 21, 2022
FavIcon Switcher <= 1.2.11 - Cross-Site Request Forgery CVE-2022-40219 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 21, 2022
Multiple Plugins from Viszt Peter - Cross-Site Request Forgery CVE-2022-3154 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 14, 2022
Bitcoin / Altcoin Faucet <= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2022-3025 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H August 31, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation