Wordfence Intelligence   >   Vulnerability Researchers   >   Lucio Sá

Lucio Sá

21
All Time Ranking
126
All Time Discoveries

8 Achievements

Learn more about Achievements
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 24, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
March 19, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 6, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 12, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
January 17, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 16, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
December 19, 2023
Learn more Learn more about Achievements

Showing 41-60 of 126 Vulnerabilities

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization
6.3
CVE-2024-3942
Apr 29, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.7 - Improper Authorization
6.3
CVE-2024-1677
Apr 29, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
AI Post Generator | AutoWriter <= 3.3 - Missing Authorization
6.3
CVE-2024-1850
Mar 21, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list
6.3
CVE-2024-1851
Mar 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Christmas Greetings <= 1.2.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-2116
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Archivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-1810
Feb 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Checkout Files Upload for WooCommerce <= 2.1.2 - Cross-Site Scripting
6.1
CVE-2022-29425
May 4, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification
5.4
CVE-2024-3722
May 8, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process
5.4
CVE-2023-7065
May 3, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization
5.4
CVE-2024-1809
Apr 29, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication
5.4
CVE-2024-1641
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
5.4
CVE-2024-1502
Mar 12, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
5.4
CVE-2024-1687
Feb 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
5.4
CVE-2024-1758
Feb 23, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
5.4
CVE-2024-1340
Feb 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery
5.4
CVE-2023-6788
Jan 8, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
5.4
CVE-2023-6556
Dec 23, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval
5.3
CVE-2024-1688
Apr 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Classified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion
5.3
CVE-2024-3893
Apr 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
5.3
CVE ID Unknown
Apr 4, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization CVE-2024-3942 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L April 29, 2024
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.7 - Improper Authorization CVE-2024-1677 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L April 29, 2024
AI Post Generator | AutoWriter <= 3.3 - Missing Authorization CVE-2024-1850 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L March 21, 2024
affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list CVE-2024-1851 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L March 7, 2024
Christmas Greetings <= 1.2.5 - Reflected Cross-Site Scripting CVE-2024-2116 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 28, 2024
Archivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting CVE-2024-1810 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N February 23, 2024
Checkout Files Upload for WooCommerce <= 2.1.2 - Cross-Site Scripting CVE-2022-29425 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N May 4, 2022
Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification CVE-2024-3722 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N May 8, 2024
Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process CVE-2023-7065 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L May 3, 2024
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization CVE-2024-1809 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N April 29, 2024
Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication CVE-2024-1641 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N March 13, 2024
Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion CVE-2024-1502 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L March 12, 2024
Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2024-1687 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N February 26, 2024
SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery CVE-2024-1758 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N February 23, 2024
Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization CVE-2024-1340 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N February 9, 2024
Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery CVE-2023-6788 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N January 8, 2024
FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2023-6556 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N December 23, 2023
Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval CVE-2024-1688 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 29, 2024
Classified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion CVE-2024-3893 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 24, 2024
ARMember <= 4.0.27 - Directory Traversal via X-FILENAME 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 4, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation