Wordfence Intelligence   >   Vulnerability Researchers   >   Marco Wotschka

Marco Wotschka

Organization: Wordfence

9
All Time Ranking
228
All Time Discoveries

1 Achievement

Learn more about Achievements
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
November 13, 2023
Learn more Learn more about Achievements

Showing 201-220 of 228 Vulnerabilities

Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
8.1
CVE-2023-4386
Sep 13, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products
8.1
CVE-2023-4402
Sep 13, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference
8.1
CVE-2023-0550
Jan 27, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery
8.1
CVE-2023-0554
Jan 27, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Quick Restaurant Menu <= 2.0.2 - Missing Authorization
8.1
CVE-2023-0555
Jan 27, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal
8.7
CVE-2023-5504
Nov 22, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export
8.8
CVE-2023-3677
Aug 11, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Quick Post Duplicator <= 2.0 - Authenticated (Contributor+) SQL Injection via post_id
8.8
CVE-2023-2229
Jun 22, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id
8.8
CVE-2023-2201
Jun 1, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WP Replicate Post <= 4.0.2 - Authenticated (Contributor+) SQL Injection
8.8
CVE-2023-2237
May 10, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgery
8.8
CVE-2023-0088
Dec 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery
8.8
CVE-2023-0294
Dec 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery
8.8
CVE-2022-4021
Nov 16, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
8.8
CVE-2022-3240
Nov 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Cross-Site Request Forgery to Settings update
8.8
CVE-2022-2942
Nov 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery
8.8
CVE-2022-3898
Nov 8, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
VR Calendar <= 2.3.3 - Cross-Site Request Forgery
8.8
CVE-2022-3852
Nov 3, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Corner Ad <= 1.0.56 - Cross-Site Request Forgery
8.8
CVE-2022-3427
Sep 9, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update
8.8
CVE-2022-2432
Jul 11, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
9.1
CVE-2023-5414
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries CVE-2023-4386 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H September 13, 2023
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products CVE-2023-4402 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H September 13, 2023
Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference CVE-2023-0550 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H January 27, 2023
Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery CVE-2023-0554 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H January 27, 2023
Quick Restaurant Menu <= 2.0.2 - Missing Authorization CVE-2023-0555 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H January 27, 2023
BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal CVE-2023-5504 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H November 22, 2023
WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export CVE-2023-3677 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H August 11, 2023
Quick Post Duplicator <= 2.0 - Authenticated (Contributor+) SQL Injection via post_id CVE-2023-2229 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H June 22, 2023
Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id CVE-2023-2201 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H June 1, 2023
WP Replicate Post <= 4.0.2 - Authenticated (Contributor+) SQL Injection CVE-2023-2237 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H May 10, 2023
Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgery CVE-2023-0088 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H December 14, 2022
Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery CVE-2023-0294 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H December 14, 2022
Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery CVE-2022-4021 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 16, 2022
Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting CVE-2022-3240 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 14, 2022
Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Cross-Site Request Forgery to Settings update CVE-2022-2942 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 14, 2022
WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery CVE-2022-3898 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 8, 2022
VR Calendar <= 2.3.3 - Cross-Site Request Forgery CVE-2022-3852 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 3, 2022
Corner Ad <= 1.0.56 - Cross-Site Request Forgery CVE-2022-3427 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 9, 2022
Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update CVE-2022-2432 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H July 11, 2022
Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read CVE-2023-5414 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H October 11, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation