Wordfence Intelligence   >   Vulnerability Researchers   >   Wordfence PRISM

Wordfence PRISM

Organization: Wordfence

51
All Time Ranking
157
All Time Discoveries
155
90 Day Published Submissions
31 Jul '26
Last Published Submission

About

A prism decomposes light into its full spectrum, revealing what was always there but invisible to the naked eye. PRISM does the same to code, each specialist agent analyzes a different wavelength of the vulnerability spectrum, from XSS to deserialization, guided by WordPress ground truth and validated through empirical proof-of-concept execution.

12 Achievements

Learn more about Achievements
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
July 23, 2026
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
July 23, 2026
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
July 15, 2026
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
July 10, 2026
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
June 30, 2026
Submitted LFI Vulnerability
Submitted LFI Vulnerability
June 30, 2026
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
June 24, 2026
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
June 17, 2026
Submitted XSS Vulnerability
Submitted XSS Vulnerability
June 17, 2026
1337 Vulnerability Researcher
1337 Vulnerability Researcher
May 7, 2026
Submitted 1 Vulnerability
Submitted 1 Vulnerability
April 16, 2026
Submitted SQLi Vulnerability
Submitted SQLi Vulnerability
April 16, 2026
Learn more Learn more about Achievements

Showing 141-157 of 157 Vulnerabilities

Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
7.5
CVE-2026-12923
Jun 30, 2026
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action
4.3
CVE-2026-12133
Jun 30, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
6.5
CVE-2026-13333
Jun 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta
6.4
CVE-2026-13335
Jun 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
4.3
CVE-2026-13422
Jun 26, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter
6.5
CVE-2026-13331
Jun 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
6.5
CVE-2026-13226
Jun 25, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter
7.5
CVE-2026-12937
Jun 24, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
6.5
CVE-2026-12119
Jun 19, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
7.5
CVE-2026-11911
Jun 19, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
7.5
CVE-2026-11912
Jun 19, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
4.3
CVE-2026-12111
Jun 17, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-12136
Jun 17, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter
6.1
CVE-2026-12137
Jun 17, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
8.8
CVE-2026-12165
Jun 16, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
9.8
CVE-2026-8181
May 13, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
6.5
CVE-2026-6080
Apr 16, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Title CVE ID CVSS Vector Date
Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter CVE-2026-12923 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H June 30, 2026
JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action CVE-2026-12133 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N June 30, 2026
Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter CVE-2026-13333 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N June 26, 2026
CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta CVE-2026-13335 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 26, 2026
HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers CVE-2026-13422 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N June 26, 2026
Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter CVE-2026-13331 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N June 26, 2026
Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter CVE-2026-13226 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N June 25, 2026
Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter CVE-2026-12937 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N June 24, 2026
Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute CVE-2026-12119 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N June 19, 2026
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter CVE-2026-11911 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N June 19, 2026
Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action CVE-2026-11912 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N June 19, 2026
Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter CVE-2026-12111 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N June 17, 2026
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-12136 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 17, 2026
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter CVE-2026-12137 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N June 17, 2026
Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter CVE-2026-12165 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H June 16, 2026
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover CVE-2026-8181 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H May 13, 2026
Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter CVE-2026-6080 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N April 16, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation