Wordfence Intelligence   >   Vulnerability Researchers   >   Mika

Mika

4
All Time Ranking
308
All Time Discoveries

Showing 261-280 of 308 Vulnerabilities

All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal
6.5
CVE-2023-24416
Feb 23, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Icegram Express <= 5.5.2 - Unauthenticated CSV Injection
6.5
CVE-2022-45810
Feb 6, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection
6.5
CVE-2022-45360
Feb 2, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Site Reviews <= 6.2.0 - Unauthenticated CSV Injection
6.5
CVE-2022-46801
Jan 27, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection
6.6
CVE-2023-50843
Dec 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
WordPress Brute Force Protection – Stop Brute Force Attacks <= 2.2.5 - Authenticated (Administrator+) SQL Injection via orderby
6.6
CVE-2023-48764
Nov 28, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Inactive User Deleter <= 1.59 - Cross-Site Request Forgery via Multiple Functions
7.1
CVE-2023-27424
Apr 24, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Sticky Anything <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-30551
Mar 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Advanced Database Cleaner <= 3.1.2 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-49764
Dec 4, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
MSync <= 1.0.0 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-49166
Nov 29, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
License Manager for WooCommerce <= 2.2.10 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-48742
Nov 23, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ChatBot <= 4.7.8 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-48741
Nov 23, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery
7.2
CVE-2023-46207
Oct 19, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Travel Map <= 1.0.1 - Unauthenticated Cross-Site Scripting
7.2
CVE-2023-41860
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Woocommerce Support System <= 1.2.1 - Authenticated (Administrator+) SQL Injection via 'orderby'
7.2
CVE-2023-41685
Sep 4, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
WP Report Post <= 2.1.2 - Authenticated (Editor+) SQL Injection
7.2
CVE-2023-34168
May 30, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SIS Handball <= 1.0.45 - Authenticated (Administrator+) SQL Injection via 'orderby'
7.2
CVE-2023-33924
May 23, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Cryptocurrency Donation Box – Bitcoin & Crypto Donations <= 2.2.7 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-32128
May 5, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
WP Reroute Email <= 1.4.6 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-27605
Apr 14, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Transbank Webpay REST <= 1.6.6 - Authenticated (Administrator+) SQL Injection via orderby
7.2
CVE-2023-27610
Apr 6, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal CVE-2023-24416 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H February 23, 2023
Icegram Express <= 5.5.2 - Unauthenticated CSV Injection CVE-2022-45810 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L February 6, 2023
Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection CVE-2022-45360 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L February 2, 2023
Site Reviews <= 6.2.0 - Unauthenticated CSV Injection CVE-2022-46801 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L January 27, 2023
Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection CVE-2023-50843 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H December 21, 2023
WordPress Brute Force Protection – Stop Brute Force Attacks <= 2.2.5 - Authenticated (Administrator+) SQL Injection via orderby CVE-2023-48764 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H November 28, 2023
Inactive User Deleter <= 1.59 - Cross-Site Request Forgery via Multiple Functions CVE-2023-27424 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L April 24, 2023
Sticky Anything <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting CVE-2024-30551 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N March 29, 2024
Advanced Database Cleaner <= 3.1.2 - Authenticated (Administrator+) SQL Injection CVE-2023-49764 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H December 4, 2023
MSync <= 1.0.0 - Authenticated (Administrator+) SQL Injection CVE-2023-49166 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H November 29, 2023
License Manager for WooCommerce <= 2.2.10 - Authenticated (Administrator+) SQL Injection CVE-2023-48742 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H November 23, 2023
ChatBot <= 4.7.8 - Authenticated (Administrator+) SQL Injection CVE-2023-48741 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H November 23, 2023
Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery CVE-2023-46207 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N October 19, 2023
Travel Map <= 1.0.1 - Unauthenticated Cross-Site Scripting CVE-2023-41860 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N September 5, 2023
Woocommerce Support System <= 1.2.1 - Authenticated (Administrator+) SQL Injection via 'orderby' CVE-2023-41685 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H September 4, 2023
WP Report Post <= 2.1.2 - Authenticated (Editor+) SQL Injection CVE-2023-34168 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H May 30, 2023
SIS Handball <= 1.0.45 - Authenticated (Administrator+) SQL Injection via 'orderby' CVE-2023-33924 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H May 23, 2023
Cryptocurrency Donation Box – Bitcoin & Crypto Donations <= 2.2.7 - Authenticated (Administrator+) SQL Injection CVE-2023-32128 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H May 5, 2023
WP Reroute Email <= 1.4.6 - Authenticated (Administrator+) SQL Injection CVE-2023-27605 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H April 14, 2023
Transbank Webpay REST <= 1.6.6 - Authenticated (Administrator+) SQL Injection via orderby CVE-2023-27610 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H April 6, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation