Wordfence Intelligence   >   Vulnerability Researchers   >   Mika

Mika

4
All Time Ranking
297
All Time Discoveries

Showing 41-60 of 297 Vulnerabilities

CM Download Manager <= 2.8.5 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVE-2022-3076
Sep 5, 2022
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Inactive User Deleter <= 1.59 - Cross-Site Request Forgery via Multiple Functions
7.1
CVE-2023-27424
Apr 24, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection
6.6
CVE-2023-50843
Dec 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
WordPress Brute Force Protection – Stop Brute Force Attacks <= 2.2.5 - Authenticated (Administrator+) SQL Injection via orderby
6.6
CVE-2023-48764
Nov 28, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Quicksand Post Filter jQuery Plugin <= 3.1.1 - Cross-Site Request Forgery via renderAdmin
6.5
CVE-2024-24849
Feb 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Japanized For WooCommerce <= 2.6.4 - Missing Authorization
6.5
CVE-2023-47698
Nov 9, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Podlove Web Player <= 5.7.3 - Missing Authorization
6.5
CVE-2023-47691
Nov 9, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token
6.5
CVE-2023-46631
Oct 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints
6.5
CVE-2023-46608
Oct 24, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs
6.5
CVE-2023-46195
Oct 18, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing
6.5
CVE-2023-37865
Jul 10, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Uncanny Toolkit for LearnDash <= 3.6.4.3 - Missing Authorization via review-banner-visibility REST route
6.5
CVE-2023-34019
Jun 2, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
ReviewX <= 1.6.7 - Unauthenticated CSV Injection
6.5
CVE-2022-46809
Apr 13, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal
6.5
CVE-2023-24416
Feb 23, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Icegram Express <= 5.5.2 - Unauthenticated CSV Injection
6.5
CVE-2022-45810
Feb 6, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection
6.5
CVE-2022-45360
Feb 2, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Site Reviews <= 6.2.0 - Unauthenticated CSV Injection
6.5
CVE-2022-46801
Jan 27, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-47229
Nov 3, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PDF Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-45646
Oct 12, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
QR Twitter Widget <= 0.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
6.4
CVE-2023-45628
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
CM Download Manager <= 2.8.5 - Authenticated (Administrator+) Arbitrary File Upload CVE-2022-3076 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H September 5, 2022
Inactive User Deleter <= 1.59 - Cross-Site Request Forgery via Multiple Functions CVE-2023-27424 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L April 24, 2023
Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection CVE-2023-50843 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H December 21, 2023
WordPress Brute Force Protection – Stop Brute Force Attacks <= 2.2.5 - Authenticated (Administrator+) SQL Injection via orderby CVE-2023-48764 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H November 28, 2023
Quicksand Post Filter jQuery Plugin <= 3.1.1 - Cross-Site Request Forgery via renderAdmin CVE-2024-24849 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N February 2, 2024
Japanized For WooCommerce <= 2.6.4 - Missing Authorization CVE-2023-47698 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N November 9, 2023
Podlove Web Player <= 5.7.3 - Missing Authorization CVE-2023-47691 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N November 9, 2023
Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token CVE-2023-46631 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L October 25, 2023
DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints CVE-2023-46608 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N October 24, 2023
Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs CVE-2023-46195 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N October 18, 2023
Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing CVE-2023-37865 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N July 10, 2023
Uncanny Toolkit for LearnDash <= 3.6.4.3 - Missing Authorization via review-banner-visibility REST route CVE-2023-34019 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L June 2, 2023
ReviewX <= 1.6.7 - Unauthenticated CSV Injection CVE-2022-46809 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L April 13, 2023
All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal CVE-2023-24416 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H February 23, 2023
Icegram Express <= 5.5.2 - Unauthenticated CSV Injection CVE-2022-45810 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L February 6, 2023
Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection CVE-2022-45360 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L February 2, 2023
Site Reviews <= 6.2.0 - Unauthenticated CSV Injection CVE-2022-46801 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L January 27, 2023
Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-47229 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 3, 2023
PDF Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-45646 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 12, 2023
QR Twitter Widget <= 0.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode CVE-2023-45628 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 11, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation