Wordfence Intelligence   >   Vulnerability Researchers   >   István Márton

István Márton

Organization: Wordfence

1
All Time Ranking
803
All Time Discoveries

About

I'm an experienced WordPress developer, with a focus on plugin development at Lana Solutions. I have spent years focusing on perfecting my skills as a developer, and have recently redirected efforts towards WordPress testing, audits, and vulnerability research. Currently, I'm a vulnerability research contractor for Wordfence and continue to defy the norms by maintaining status as the #1 Researcher in WordPress due to the volume of vulnerabilities I'm able to discover and responsibly disclose.

4 Achievements

Learn more about Achievements
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
April 19, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 17, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
November 27, 2023
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
November 9, 2023
Learn more Learn more about Achievements

Showing 101-120 of 803 Vulnerabilities

Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery
4.3
CVE-2023-23899
Jan 20, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Advanced Custom Fields: Image Crop Add-on <= 1.4.12 - Improper Authorization
4.3
CVE-2023-22676
Jan 13, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Appsero <= 1.2.0 - Cross-Site Request Forgery
4.3
CVE-2022-47150
Dec 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Directorist <= 7.4.3 - Authenticated (Subscriber+) Sensitive Information Disclosure
4.3
CVE-2022-3961
Nov 28, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Organization chart <= 1.4.1 - Missing Authorization
4.3
CVE-2022-45844
Nov 26, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Appointment Booking Calendar <= 1.3.69 - Missing Authorization
4.3
CVE-2022-43482
Oct 30, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Appointment Hour Booking <= 1.3.71 - Missing Authorization
4.3
CVE-2022-41692
Oct 30, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
4.4
CVE-2023-6924
Dec 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
WP Login Box <= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-0544
Apr 17, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Easy Appointments <= 3.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-30748
Apr 14, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting
4.6
CVE-2023-2494
May 23, 2023
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Delete Me <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
4.9
CVE-2023-5126
Oct 23, 2023
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
ProfileGrid <= 5.5.0 - Hardcoded Encryption Key
4.9
CVE-2023-3404
Jul 17, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
4.9
CVE-2023-2735
May 19, 2023
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
WP User Control <= 1.5.3 - Insecure Password Reset Mechanism
5.3
CVE-2023-4915
Sep 12, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure
5.3
CVE-2023-4917
Sep 12, 2023
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EmbedPress <= 3.7.3 - Sensitive Information Exposure
5.3
CVE-2023-3371
Jun 26, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Download Theme <= 1.0.9 - Cross-Site Request Forgery via dtwap_download()
5.3
CVE-2022-38062
May 24, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WP Job Portal <= 2.0.1 - Missing Authorization to Settings Modification
5.3
CVE-2022-41786
May 5, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Active Directory Integration / LDAP Integration <= 4.1.0 - Unauthenticated Information Disclosure
5.3
CVE-2023-0812
Apr 19, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery CVE-2023-23899 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 20, 2023
Advanced Custom Fields: Image Crop Add-on <= 1.4.12 - Improper Authorization CVE-2023-22676 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 13, 2023
Appsero <= 1.2.0 - Cross-Site Request Forgery CVE-2022-47150 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N December 14, 2022
Directorist <= 7.4.3 - Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2022-3961 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N November 28, 2022
Organization chart <= 1.4.1 - Missing Authorization CVE-2022-45844 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N November 26, 2022
Appointment Booking Calendar <= 1.3.69 - Missing Authorization CVE-2022-43482 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 30, 2022
Appointment Hour Booking <= 1.3.71 - Missing Authorization CVE-2022-41692 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 30, 2022
Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget CVE-2023-6924 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N December 21, 2023
WP Login Box <= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-0544 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 17, 2023
Easy Appointments <= 3.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-30748 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 14, 2023
Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting CVE-2023-2494 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L May 23, 2023
Delete Me <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-5126 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N October 23, 2023
ProfileGrid <= 5.5.0 - Hardcoded Encryption Key CVE-2023-3404 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N July 17, 2023
Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-2735 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N May 19, 2023
WP User Control <= 1.5.3 - Insecure Password Reset Mechanism CVE-2023-4915 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N September 12, 2023
Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure CVE-2023-4917 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N September 12, 2023
EmbedPress <= 3.7.3 - Sensitive Information Exposure CVE-2023-3371 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N June 26, 2023
Download Theme <= 1.0.9 - Cross-Site Request Forgery via dtwap_download() CVE-2022-38062 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N May 24, 2023
WP Job Portal <= 2.0.1 - Missing Authorization to Settings Modification CVE-2022-41786 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N May 5, 2023
Active Directory Integration / LDAP Integration <= 4.1.0 - Unauthenticated Information Disclosure CVE-2023-0812 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 19, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation