Wordfence Intelligence   >   Vulnerability Researchers   >   Majed Refaea

Majed Refaea

54
All Time Ranking
57
All Time Discoveries

Showing 41-57 of 57 Vulnerabilities

Builderall Builder for WordPress <= 2.0.1 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2024-30532
Mar 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Nelio Content <= 3.2.0 - Authenticated (Contributor+) Server-Side Request Forgery
6.4
CVE-2024-30531
Mar 29, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Brave Popup Builder <= 0.6.5 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2024-30453
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
OSS Aliyun <= 1.4.10 - Authenticated (Administrator+) SQL Injection
9.1
CVE-2024-30494
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Tumult Hype Animations <= 1.9.11 - Cross-Site Request Forgery to Cross-Site Scripting
6.1
CVE-2024-30461
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI WP Writer <= 3.6.5 - Missing Authorization
5.6
CVE-2024-30459
Mar 28, 2024
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Multiple Page Generator Plugin – MPG <= 3.4.0 - Missing Authorization via mpg_get_log_by_project_id
4.3
CVE-2024-30235
Mar 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Photo Gallery by Ays <= 5.5.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-29919
Mar 25, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Multiple Page Generator Plugin – MPG <= 3.4.0 - Authenticated (Editor+) Remote Code Execution
7.2
CVE-2024-27951
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Super Page Cache for Cloudflare <= 4.7.5 - Cross-Site Request Forgery
4.3
CVE-2024-27968
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Adsmonetizer <= 3.1.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-1437
Feb 26, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
BeePress <= 6.9.8 - Cross-Site Request Forgery via beepress-pro.php
6.5
CVE-2024-27197
Feb 26, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
RegistrationMagic <= 5.2.5.9 - Cross-Site Request Forgery
4.3
CVE-2024-25935
Feb 20, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
InstaWP Connect <= 0.1.0.8 - Authenticated (Subscriber+) Remote Code Execution
8.8
CVE-2024-25918
Feb 14, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
InstaWP Connect <= 0.1.0.9 - Missing Authorization to Sensitive Information Dislcosure
4.3
CVE-2024-23506
Jan 24, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
InstaWP Connect <= 0.1.0.9 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2024-23507
Jan 24, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
InstaWP Connect <= 0.1.0.8 - Missing Authorization to Arbitrary Options Update
8.8
CVE-2024-22145
Jan 17, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
Builderall Builder for WordPress <= 2.0.1 - Unauthenticated Server-Side Request Forgery CVE-2024-30532 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N March 29, 2024
Nelio Content <= 3.2.0 - Authenticated (Contributor+) Server-Side Request Forgery CVE-2024-30531 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 29, 2024
Brave Popup Builder <= 0.6.5 - Unauthenticated Server-Side Request Forgery CVE-2024-30453 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N March 28, 2024
OSS Aliyun <= 1.4.10 - Authenticated (Administrator+) SQL Injection CVE-2024-30494 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H March 28, 2024
Tumult Hype Animations <= 1.9.11 - Cross-Site Request Forgery to Cross-Site Scripting CVE-2024-30461 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 28, 2024
AI WP Writer <= 3.6.5 - Missing Authorization CVE-2024-30459 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L March 28, 2024
Multiple Page Generator Plugin – MPG <= 3.4.0 - Missing Authorization via mpg_get_log_by_project_id CVE-2024-30235 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N March 26, 2024
Photo Gallery by Ays <= 5.5.2 - Reflected Cross-Site Scripting CVE-2024-29919 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 25, 2024
Multiple Page Generator Plugin – MPG <= 3.4.0 - Authenticated (Editor+) Remote Code Execution CVE-2024-27951 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H March 13, 2024
Super Page Cache for Cloudflare <= 4.7.5 - Cross-Site Request Forgery CVE-2024-27968 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N March 13, 2024
Adsmonetizer <= 3.1.2 - Reflected Cross-Site Scripting CVE-2024-1437 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N February 26, 2024
BeePress <= 6.9.8 - Cross-Site Request Forgery via beepress-pro.php CVE-2024-27197 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N February 26, 2024
RegistrationMagic <= 5.2.5.9 - Cross-Site Request Forgery CVE-2024-25935 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 20, 2024
InstaWP Connect <= 0.1.0.8 - Authenticated (Subscriber+) Remote Code Execution CVE-2024-25918 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 14, 2024
InstaWP Connect <= 0.1.0.9 - Missing Authorization to Sensitive Information Dislcosure CVE-2024-23506 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N January 24, 2024
InstaWP Connect <= 0.1.0.9 - Authenticated (Subscriber+) SQL Injection CVE-2024-23507 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 24, 2024
InstaWP Connect <= 0.1.0.8 - Missing Authorization to Arbitrary Options Update CVE-2024-22145 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 17, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation