Wordfence Intelligence   >   Vulnerability Researchers   >   Lucio Sá

Lucio Sá

21
All Time Ranking
126
All Time Discoveries

8 Achievements

Learn more about Achievements
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 24, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
March 19, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 6, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 12, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
January 17, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 16, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
December 19, 2023
Learn more Learn more about Achievements

Showing 81-100 of 126 Vulnerabilities

Archivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-1810
Feb 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
5.4
CVE-2024-1758
Feb 23, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2024-1710
Feb 23, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
4.3
CVE-2024-1362
Feb 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder
4.3
CVE-2024-1361
Feb 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation
4.3
CVE-2024-1360
Feb 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation
8.8
CVE-2024-1505
Feb 21, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation
4.7
CVE-2024-1501
Feb 20, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
7.6
CVE-2024-1217
Feb 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
4.3
CVE-2024-1218
Feb 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export
4.3
CVE-2024-1127
Feb 14, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval
5.3
CVE-2024-1126
Feb 14, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page
4.3
CVE-2024-1390
Feb 13, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return
5.3
CVE-2024-1389
Feb 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change
5.3
CVE-2024-1322
Feb 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication
6.5
CVE-2024-1318
Feb 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection
8.8
CVE-2024-1317
Feb 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
5.4
CVE-2024-1340
Feb 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton
8.8
CVE-2024-1206
Feb 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval
5.3
CVE-2024-1079
Feb 6, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
Archivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting CVE-2024-1810 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N February 23, 2024
SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery CVE-2024-1758 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N February 23, 2024
Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-1710 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 23, 2024
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh CVE-2024-1362 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 22, 2024
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder CVE-2024-1361 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 22, 2024
Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation CVE-2024-1360 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 22, 2024
Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation CVE-2024-1505 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 21, 2024
Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation CVE-2024-1501 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N February 20, 2024
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation CVE-2024-1217 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L February 19, 2024
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization CVE-2024-1218 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N February 19, 2024
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export CVE-2024-1127 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N February 14, 2024
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval CVE-2024-1126 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N February 14, 2024
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page CVE-2024-1390 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 13, 2024
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return CVE-2024-1389 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N February 13, 2024
Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change CVE-2024-1322 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N February 12, 2024
RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication CVE-2024-1318 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N February 9, 2024
RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection CVE-2024-1317 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 9, 2024
Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization CVE-2024-1340 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N February 9, 2024
WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton CVE-2024-1206 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 7, 2024
Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval CVE-2024-1079 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N February 6, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation