Rafie Muhammad

Organization: Patchstack

2
All Time Ranking
488
All Time Discoveries

Showing 1-20 of 488 Vulnerabilities

Title CVE ID CVSS Vector Date
HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal CVE-2024-38706 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N July 11, 2024
EmbedPress <= 4.0.4 - Missing Authorization CVE-2024-38707 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 11, 2024
YITH WooCommerce Ajax Product Filter <= 5.1.0 - Reflected Cross-Site Scripting CVE-2024-37943 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 10, 2024
The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events CVE-2024-37518 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 5, 2024
Spectra <= 2.13.7 - Missing Authorization via generate_ai_content CVE-2024-37517 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 5, 2024
Featured Image from URL <= 4.8.2 - Missing Authorization CVE-2024-37516 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 5, 2024
The Post Grid <= 7.7.4 - Missing Authorization via REST API CVE-2024-37481 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 4, 2024
The Post Grid <= 7.7.4 - Missing Authorization via AJAX CVE-2024-37482 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 4, 2024
The Post Grid <= 7.7.4 - Missing Authorization via save_block_css CVE-2024-37483 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 4, 2024
Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2024-37934 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 4, 2024
Newspack Content Converter <= 0.1.5 - Missing Authorization CVE-2024-37477 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 1, 2024
Newspack Newsletters <= 2.13.2 - Missing Authorization CVE-2024-37475 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 1, 2024
Newspack Ads <= 1.47.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-37474 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 1, 2024
Newspack Campaigns <= 2.31.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-37476 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 1, 2024
Woffice Core <= 5.4.8 - Reflected Cross-Site Scripting CVE-2024-37471 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 1, 2024
Woffice <= 5.4.8 - Reflected Cross-Site Scripting CVE-2024-37472 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 1, 2024
Woffice Core <= 5.4.8 - Missing Authorization CVE-2024-37470 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 1, 2024
Featured Image from URL <= 4.8.1 - Missing Authorization CVE-2024-37276 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N June 28, 2024
Newspack Blocks <= 3.0.8 - Authenticated (Contributor+) Arbitrary File Upload CVE-2024-37424 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H June 28, 2024
Newspack Blocks <= 3.0.8 - Missing Authorization CVE-2024-37425 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N June 28, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation