Wordfence Intelligence   >   Vulnerability Researchers   >   minhtuanact

minhtuanact

45
All Time Ranking
67
All Time Discoveries

Showing 1-20 of 67 Vulnerabilities

affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.9 - Open Redirect via atkpout.php
3.4
CVE-2023-45105
Oct 6, 2023
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
Landing Page Builder <= 1.5.1.5 - Open Redirect
4.3
CVE-2023-48325
Nov 23, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Kodex Posts likes <= 2.4.3 - Cross-Site Request Forgery
4.3
CVE-2022-46814
Apr 19, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Dynamics 365 Integration <= 1.3.13 - Missing Authorization via init
4.3
CVE-2023-29422
Apr 6, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affiliates Manager <= 2.9.20 - Cross-Site Request Forgery via process_bulk_action()
4.3
CVE-2023-28986
Mar 29, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP ULike <= 4.6.4 - Race Condition
4.3
CVE-2022-45842
Nov 24, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Integrate Google Drive <= 1.3.2 - Open Redirect via state
4.7
CVE-2023-47548
Nov 7, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization
5.3
CVE-2023-47693
Nov 9, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Libsyn Publisher Hub <= 1.4.4 - Sensitive Information Exposure
5.3
CVE-2023-45834
Oct 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Woo Custom Emails <= 2.2 - Missing Authorization to Unauthenticated Settings Change
5.3
CVE-2023-32507
May 10, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Doofinder for WooCommerce <= 1.5.49 - Unauthenticated Open Redirect
5.4
CVE-2023-40602
Aug 17, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Dynamic Visibility for Elementor <= 5.0.5 - Missing Authorization to Authenticated(Subscriber+) Post Visibility Modification
5.4
CVE-2023-35046
Jun 3, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Order Your Posts Manually <= 2.2.5 - Reflected Cross-Site Scripting via 'cat_id'
5.4
CVE-2023-32509
May 10, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Joli Table of Contents <= 1.3.9 - Cross-Site Request Forgery
5.4
CVE-2022-46820
Jan 3, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Envira Gallery Lite <= 1.8.3.2 - Cross-Site Scripting
5.4
CVE-2021-24126
Dec 19, 2020
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EazyDocs <= 2.3.5 - Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page
6.1
CVE-2023-47549
Nov 7, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Libsyn Publisher Hub <= 1.4.4 - Unauthenticated Cross-Site Scripting
6.1
CVE-2023-45835
Oct 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Copy Or Move Comments <= 5.0.4 - Reflected Cross-Site Scripting
6.1
CVE-2023-45634
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GD Security Headers <= 1.6.1 - Reflected Cross-Site Scripting
6.1
CVE-2023-40330
Aug 17, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PixTypes <= 1.4.15 - Reflected Cross-Site Scripting
6.1
CVE-2023-40205
Aug 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.9 - Open Redirect via atkpout.php CVE-2023-45105 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N October 6, 2023
Landing Page Builder <= 1.5.1.5 - Open Redirect CVE-2023-48325 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N November 23, 2023
Kodex Posts likes <= 2.4.3 - Cross-Site Request Forgery CVE-2022-46814 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 19, 2023
Dynamics 365 Integration <= 1.3.13 - Missing Authorization via init CVE-2023-29422 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N April 6, 2023
Affiliates Manager <= 2.9.20 - Cross-Site Request Forgery via process_bulk_action() CVE-2023-28986 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N March 29, 2023
WP ULike <= 4.6.4 - Race Condition CVE-2022-45842 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N November 24, 2022
Integrate Google Drive <= 1.3.2 - Open Redirect via state CVE-2023-47548 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N November 7, 2023
Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization CVE-2023-47693 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 9, 2023
Libsyn Publisher Hub <= 1.4.4 - Sensitive Information Exposure CVE-2023-45834 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N October 13, 2023
Woo Custom Emails <= 2.2 - Missing Authorization to Unauthenticated Settings Change CVE-2023-32507 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N May 10, 2023
Doofinder for WooCommerce <= 1.5.49 - Unauthenticated Open Redirect CVE-2023-40602 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N August 17, 2023
Dynamic Visibility for Elementor <= 5.0.5 - Missing Authorization to Authenticated(Subscriber+) Post Visibility Modification CVE-2023-35046 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L June 3, 2023
Order Your Posts Manually <= 2.2.5 - Reflected Cross-Site Scripting via 'cat_id' CVE-2023-32509 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N May 10, 2023
Joli Table of Contents <= 1.3.9 - Cross-Site Request Forgery CVE-2022-46820 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L January 3, 2023
Envira Gallery Lite <= 1.8.3.2 - Cross-Site Scripting CVE-2021-24126 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N December 19, 2020
EazyDocs <= 2.3.5 - Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page CVE-2023-47549 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N November 7, 2023
Libsyn Publisher Hub <= 1.4.4 - Unauthenticated Cross-Site Scripting CVE-2023-45835 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 13, 2023
Copy Or Move Comments <= 5.0.4 - Reflected Cross-Site Scripting CVE-2023-45634 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 11, 2023
GD Security Headers <= 1.6.1 - Reflected Cross-Site Scripting CVE-2023-40330 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N August 17, 2023
PixTypes <= 1.4.15 - Reflected Cross-Site Scripting CVE-2023-40205 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N August 11, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation