Wordfence Intelligence   >   Vulnerability Researchers   >   Marco Wotschka

Marco Wotschka

Organization: Wordfence

9
All Time Ranking
228
All Time Discoveries

1 Achievement

Learn more about Achievements
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
November 13, 2023
Learn more Learn more about Achievements

Showing 21-40 of 228 Vulnerabilities

AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
9.6
CVE-2023-5212
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response
9.8
CVE-2023-5204
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions
4.3
CVE-2023-5534
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
5.3
CVE-2023-5533
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Hotjar <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-1259
Oct 5, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-4021
Sep 28, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation
4.3
CVE-2023-4940
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation
4.3
CVE-2023-4935
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Deletion
4.3
CVE-2023-4935
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
4.3
CVE-2023-4920
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion
5.4
CVE-2023-4923
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
BEAR <= 1.1.3.3 - Missing Authorization to Product Deletion
5.4
CVE-2023-4924
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion
5.4
CVE-2023-4926
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation
4.3
CVE-2023-4942
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation
4.3
CVE-2023-4937
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation
4.3
CVE-2023-4938
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation
4.3
CVE-2023-4941
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation
4.3
CVE-2023-4943
Sep 25, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
5.3
CVE-2023-4668
Sep 22, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax
5.3
CVE-2023-4645
Sep 22, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file CVE-2023-5212 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H October 11, 2023
AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response CVE-2023-5204 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H October 11, 2023
AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions CVE-2023-5534 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 11, 2023
AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions CVE-2023-5533 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N October 11, 2023
Hotjar <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-1259 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N October 5, 2023
Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-4021 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N September 28, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation CVE-2023-4940 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation CVE-2023-4935 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Deletion CVE-2023-4935 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2023-4920 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion CVE-2023-4923 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L September 25, 2023
BEAR <= 1.1.3.3 - Missing Authorization to Product Deletion CVE-2023-4924 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L September 25, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion CVE-2023-4926 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L September 25, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation CVE-2023-4942 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation CVE-2023-4937 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation CVE-2023-4938 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation CVE-2023-4941 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 25, 2023
BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation CVE-2023-4943 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 25, 2023
Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe CVE-2023-4668 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N September 22, 2023
Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax CVE-2023-4645 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N September 22, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation