István Márton

Organization: Wordfence

1
All Time Ranking
802
All Time Discoveries

About

I'm an experienced WordPress developer, with a focus on plugin development at Lana Solutions. I have spent years focusing on perfecting my skills as a developer, and have recently redirected efforts towards WordPress testing, audits, and vulnerability research. Currently, I'm a vulnerability research contractor for Wordfence and continue to defy the norms by maintaining status as the #1 Researcher in WordPress due to the volume of vulnerabilities I'm able to discover and responsibly disclose.

Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 17, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
November 27, 2023
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
November 9, 2023

Showing 1-20 of 802 Vulnerabilities

Title CVE ID CVSS Vector Date
Simple Single Sign On <= 4.1.1 - Insecure OAuth Implementation to Authentication Bypass CVE-2022-2083 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H June 4, 2022
OAuth Single Sign On – SSO (OAuth Client) <= 6.22.5 - Authentication Bypass CVE-2022-2133 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H June 27, 2022
WP OAuth2 Server <= 1.0.1 - Authentication Bypass CVE-2022-34839 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L July 18, 2022
WP OAuth Server <= 3.0.4 - Authentication Bypass CVE-2022-34149 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H August 2, 2022
OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO ) <= 3.0.3 - Missing Authorization CVE-2022-3119 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L August 23, 2022
Better Delete Revision <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2022-37412 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N August 28, 2022
Bitcoin Satoshi Tools <= 1.7.0 - Missing Authorization to Stored Cross-Site Scripting CVE-2022-3024 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N August 31, 2022
Bitcoin / Altcoin Faucet <= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2022-3025 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H August 31, 2022
Ldap WP Login / Active Directory Integration <= 3.0.1 - Missing Authorization CVE-2022-2987 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L September 5, 2022
Multiple Plugins from Viszt Peter - Cross-Site Request Forgery CVE-2022-3154 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 14, 2022
WP Custom Cursors <= 3.0 - Cross-Site Request Forgery to Cursor Manipulation CVE-2022-3151 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 21, 2022
WP Custom Cursors <= 3.0.1 - Authenticated (Administrator+) SQL Injection CVE-2022-3150 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H September 21, 2022
WP Custom Cursors <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2022-3149 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N September 21, 2022
FavIcon Switcher <= 1.2.11 - Cross-Site Request Forgery CVE-2022-40219 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 21, 2022
3D Tag Cloud <= 3.8 - Cross-Site Request Forgery CVE-2022-36417 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 22, 2022
miniOrange Discord Integration <= 2.1.5 - Missing Authorization to Plugin Options Update CVE-2022-3082 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N September 22, 2022
WordPress Social Login and Register <=7.5.12 - Missing Authorization to Plugin Settings Update CVE-2023-24375 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N September 23, 2022
Backup Scheduler <= 1.5.13 - Cross-Site Request Forgery CVE-2022-38079 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 23, 2022
Official Integration for Billingo <= 3.3.9 - Reflected Cross-Site Scripting CVE-2022-3420 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 7, 2022
Csomagpontok és szállítási címkék WooCommerce hez <= 1.9.0.2 - Cross-Site Request Forgery CVE-2022-41685 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 20, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation