Wordfence Intelligence   >   Vulnerability Researchers   >   Majed Refaea

Majed Refaea

37
All Time Ranking
95
All Time Discoveries

Showing 1-20 of 95 Vulnerabilities

Telegram Bot & Channel <= 3.8.2 - Cross-Site Request Forgery
4.3
CVE-2024-38789
Jul 20, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP GoToWebinar <= 15.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-38776
Jul 19, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Fast Total Search <= 1.69.234 - Cross-Site Request Forgery
4.3
CVE-2024-38778
Jul 19, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Dynamic Word Spinner: CSS3 Animated Rotation <= 5.6 - Cross-Site Request Forgery
4.3
CVE-2024-38753
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WappPress <= 6.0.4 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2024-38758
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP GoToWebinar <= 15.6 - Missing Authorization
4.3
CVE-2024-38695
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Magical Addons For Elementor <= 1.1.41 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2024-38730
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Taggbox <= 3.3 - Cross-Site Request Forgery
4.3
CVE-2024-38754
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-38752
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Google Adsense & Banner Ads by AdsforWP <= 1.9.28 - Cross-Site Request Forgery
4.3
CVE-2024-38751
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Meks Video Importer <= 1.0.11 - Missing Authorization
4.3
CVE-2024-38733
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WP Fast Total Search <= 1.68.232 - Missing Authorization
4.3
CVE-2024-38714
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
MakeStories (for Google Web Stories) <= 3.0.3 - Authenticated (Subscriber+) Arbitrary File Download and Server-Side Request Forgery
4.3
CVE-2024-38746
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Metorik – Reports & Email Automation for WooCommerce <= 1.7.1 - Cross-Site Request Forgery
4.3
CVE-2024-38691
Jul 10, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
codoc <= 0.9.51.12 - Reflected Cross-Site Scripting
6.1
CVE-2024-37961
Jul 10, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP GoToWebinar <= 15.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-38671
Jul 10, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Cliengo – Chatbot <= 3.0.1 - Cross-Site Request Forgery
5.4
CVE-2024-37923
Jul 9, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Ultimate Auction <= 4.2.5 - Cross-Site Request Forgery
4.3
CVE-2024-37543
Jul 6, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-37420
Jun 28, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
WPAdverts – Classifieds Plugin <= 2.1.2 - Cross-Site Request Forgery
4.3
CVE-2024-37238
Jun 21, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Telegram Bot & Channel <= 3.8.2 - Cross-Site Request Forgery CVE-2024-38789 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 20, 2024
WP GoToWebinar <= 15.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-38776 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 19, 2024
WP Fast Total Search <= 1.69.234 - Cross-Site Request Forgery CVE-2024-38778 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 19, 2024
Dynamic Word Spinner: CSS3 Animated Rotation <= 5.6 - Cross-Site Request Forgery CVE-2024-38753 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 11, 2024
WappPress <= 6.0.4 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2024-38758 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
WP GoToWebinar <= 15.6 - Missing Authorization CVE-2024-38695 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 11, 2024
Magical Addons For Elementor <= 1.1.41 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2024-38730 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Taggbox <= 3.3 - Cross-Site Request Forgery CVE-2024-38754 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 11, 2024
Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-38752 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Google Adsense & Banner Ads by AdsforWP <= 1.9.28 - Cross-Site Request Forgery CVE-2024-38751 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 11, 2024
Meks Video Importer <= 1.0.11 - Missing Authorization CVE-2024-38733 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 11, 2024
WP Fast Total Search <= 1.68.232 - Missing Authorization CVE-2024-38714 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 11, 2024
MakeStories (for Google Web Stories) <= 3.0.3 - Authenticated (Subscriber+) Arbitrary File Download and Server-Side Request Forgery CVE-2024-38746 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N July 11, 2024
Metorik – Reports & Email Automation for WooCommerce <= 1.7.1 - Cross-Site Request Forgery CVE-2024-38691 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 10, 2024
codoc <= 0.9.51.12 - Reflected Cross-Site Scripting CVE-2024-37961 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 10, 2024
WP GoToWebinar <= 15.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-38671 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 10, 2024
Cliengo – Chatbot <= 3.0.1 - Cross-Site Request Forgery CVE-2024-37923 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L July 9, 2024
Ultimate Auction <= 4.2.5 - Cross-Site Request Forgery CVE-2024-37543 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 6, 2024
Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-37420 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H June 28, 2024
WPAdverts – Classifieds Plugin <= 2.1.2 - Cross-Site Request Forgery CVE-2024-37238 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N June 21, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation