Wordfence Intelligence   >   Vulnerability Researchers   >   István Márton

István Márton

Organization: Wordfence

1
All Time Ranking
803
All Time Discoveries

About

I'm an experienced WordPress developer, with a focus on plugin development at Lana Solutions. I have spent years focusing on perfecting my skills as a developer, and have recently redirected efforts towards WordPress testing, audits, and vulnerability research. Currently, I'm a vulnerability research contractor for Wordfence and continue to defy the norms by maintaining status as the #1 Researcher in WordPress due to the volume of vulnerabilities I'm able to discover and responsibly disclose.

4 Achievements

Learn more about Achievements
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
April 19, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 17, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
November 27, 2023
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
November 9, 2023
Learn more Learn more about Achievements

Showing 781-800 of 803 Vulnerabilities

Fontiran <= 2.1 - Missing Authorization via fi_add_rule and fi_delete_webfont_php
4.3
CVE-2023-25791
Feb 15, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Tickera <= 3.5.1.0 - Cross-Site Request Forgery to Ticket Post Status Change
4.3
CVE-2023-23726
Feb 14, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to Post Thumbnail Change
4.3
CVE-2022-38468
Feb 14, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Google Maps CP <= 1.0.43 - Cross-Site Request Forgery via feedback_action
4.3
CVE ID Unknown
Feb 6, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
PayPal Brasil para WooCommerce <= 1.4.2 - Cross-Site Request Forgery
4.3
CVE-2023-25026
Feb 6, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Booking Calendar Contact Form <= 1.2.34 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission
4.3
CVE-2023-25037
Feb 6, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Booking Calendar Contact Form <= 1.2.34 - Cross-Site Request Forgery via cpdexbccf_feedback
4.3
CVE ID Unknown
Feb 6, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Google Maps CP <= 1.0.43 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission
4.3
CVE-2023-25039
Feb 6, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Ajax Search Lite <= 4.10.3 - Missing Authorization leading to Authenticated (Subscriber+) Sensitive Information Disclosure
4.3
CVE-2022-38456
Feb 6, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
We’re Open! <= 1.45 - Cross-Site Request Forgery
4.3
CVE-2023-25067
Feb 2, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP Tabs <= 2.1.14 - Cross Site Request Forgery
4.3
CVE-2023-25065
Feb 2, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Robo Gallery <= 3.2.9 - Cross-Site Request Forgery via getPluginStatus
4.3
CVE-2022-45804
Feb 2, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Ecwid Ecommerce Shopping Cart <= 6.11.3 - Cross Site Request Forgery
4.3
CVE-2023-24377
Jan 27, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Ultimate Addons for Beaver Builder - Lite <= 1.5.5 - Authenticated (Subscriber+) Settings Change
4.3
CVE-2023-23882
Jan 24, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery
4.3
CVE-2023-23899
Jan 20, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Advanced Custom Fields: Image Crop Add-on <= 1.4.12 - Improper Authorization
4.3
CVE-2023-22676
Jan 13, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Appsero <= 1.2.0 - Cross-Site Request Forgery
4.3
CVE-2022-47150
Dec 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Directorist <= 7.4.3 - Authenticated (Subscriber+) Sensitive Information Disclosure
4.3
CVE-2022-3961
Nov 28, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Organization chart <= 1.4.1 - Missing Authorization
4.3
CVE-2022-45844
Nov 26, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Appointment Booking Calendar <= 1.3.69 - Missing Authorization
4.3
CVE-2022-43482
Oct 30, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Fontiran <= 2.1 - Missing Authorization via fi_add_rule and fi_delete_webfont_php CVE-2023-25791 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 15, 2023
Tickera <= 3.5.1.0 - Cross-Site Request Forgery to Ticket Post Status Change CVE-2023-23726 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 14, 2023
NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to Post Thumbnail Change CVE-2022-38468 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 14, 2023
Google Maps CP <= 1.0.43 - Cross-Site Request Forgery via feedback_action 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 6, 2023
PayPal Brasil para WooCommerce <= 1.4.2 - Cross-Site Request Forgery CVE-2023-25026 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 6, 2023
Booking Calendar Contact Form <= 1.2.34 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission CVE-2023-25037 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 6, 2023
Booking Calendar Contact Form <= 1.2.34 - Cross-Site Request Forgery via cpdexbccf_feedback 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 6, 2023
Google Maps CP <= 1.0.43 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission CVE-2023-25039 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 6, 2023
Ajax Search Lite <= 4.10.3 - Missing Authorization leading to Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2022-38456 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N February 6, 2023
We’re Open! <= 1.45 - Cross-Site Request Forgery CVE-2023-25067 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 2, 2023
WP Tabs <= 2.1.14 - Cross Site Request Forgery CVE-2023-25065 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 2, 2023
Robo Gallery <= 3.2.9 - Cross-Site Request Forgery via getPluginStatus CVE-2022-45804 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 2, 2023
Ecwid Ecommerce Shopping Cart <= 6.11.3 - Cross Site Request Forgery CVE-2023-24377 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 27, 2023
Ultimate Addons for Beaver Builder - Lite <= 1.5.5 - Authenticated (Subscriber+) Settings Change CVE-2023-23882 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 24, 2023
Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery CVE-2023-23899 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 20, 2023
Advanced Custom Fields: Image Crop Add-on <= 1.4.12 - Improper Authorization CVE-2023-22676 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 13, 2023
Appsero <= 1.2.0 - Cross-Site Request Forgery CVE-2022-47150 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N December 14, 2022
Directorist <= 7.4.3 - Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2022-3961 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N November 28, 2022
Organization chart <= 1.4.1 - Missing Authorization CVE-2022-45844 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N November 26, 2022
Appointment Booking Calendar <= 1.3.69 - Missing Authorization CVE-2022-43482 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 30, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation