Wordfence Intelligence   >   Vulnerability Researchers   >   Rafie Muhammad

Rafie Muhammad

Organization: Patchstack

2
All Time Ranking
489
All Time Discoveries

Showing 1-20 of 489 Vulnerabilities

Security Optimizer – The All-In-One Protection Plugin <= 1.5.0 - Missing Authorization via hide_notice()
4.3
CVE-2024-38774
Jul 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal
4.3
CVE-2024-38706
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EmbedPress <= 4.0.4 - Missing Authorization
5.3
CVE-2024-38707
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
YITH WooCommerce Ajax Product Filter <= 5.1.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-37943
Jul 10, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events
4.3
CVE-2024-37518
Jul 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Spectra <= 2.13.7 - Missing Authorization via generate_ai_content
4.3
CVE-2024-37517
Jul 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Featured Image from URL <= 4.8.2 - Missing Authorization
4.3
CVE-2024-37516
Jul 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
The Post Grid <= 7.7.4 - Missing Authorization via REST API
5.3
CVE-2024-37481
Jul 4, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The Post Grid <= 7.7.4 - Missing Authorization via AJAX
4.3
CVE-2024-37482
Jul 4, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
The Post Grid <= 7.7.4 - Missing Authorization via save_block_css
4.3
CVE-2024-37483
Jul 4, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
4.3
CVE-2024-37934
Jul 4, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Woffice <= 5.4.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-37472
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Newspack Content Converter <= 0.1.5 - Missing Authorization
4.3
CVE-2024-37477
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Newspack Newsletters <= 2.13.2 - Missing Authorization
5.3
CVE-2024-37475
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Newspack Ads <= 1.47.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-37474
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Newspack Campaigns <= 2.31.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-37476
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Woffice Core <= 5.4.8 - Missing Authorization
5.3
CVE-2024-37470
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Woffice Core <= 5.4.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-37471
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Defender Security <= 4.7.2 - Missing Authorization
5.3
CVE-2024-37444
Jun 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Newspack Blocks <= 3.0.8 - Missing Authorization
4.3
CVE-2024-37425
Jun 28, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
Security Optimizer – The All-In-One Protection Plugin <= 1.5.0 - Missing Authorization via hide_notice() CVE-2024-38774 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 19, 2024
HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal CVE-2024-38706 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N July 11, 2024
EmbedPress <= 4.0.4 - Missing Authorization CVE-2024-38707 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 11, 2024
YITH WooCommerce Ajax Product Filter <= 5.1.0 - Reflected Cross-Site Scripting CVE-2024-37943 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 10, 2024
The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events CVE-2024-37518 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 5, 2024
Spectra <= 2.13.7 - Missing Authorization via generate_ai_content CVE-2024-37517 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 5, 2024
Featured Image from URL <= 4.8.2 - Missing Authorization CVE-2024-37516 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 5, 2024
The Post Grid <= 7.7.4 - Missing Authorization via REST API CVE-2024-37481 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 4, 2024
The Post Grid <= 7.7.4 - Missing Authorization via AJAX CVE-2024-37482 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 4, 2024
The Post Grid <= 7.7.4 - Missing Authorization via save_block_css CVE-2024-37483 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 4, 2024
Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2024-37934 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 4, 2024
Woffice <= 5.4.8 - Reflected Cross-Site Scripting CVE-2024-37472 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 1, 2024
Newspack Content Converter <= 0.1.5 - Missing Authorization CVE-2024-37477 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 1, 2024
Newspack Newsletters <= 2.13.2 - Missing Authorization CVE-2024-37475 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 1, 2024
Newspack Ads <= 1.47.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-37474 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 1, 2024
Newspack Campaigns <= 2.31.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-37476 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 1, 2024
Woffice Core <= 5.4.8 - Missing Authorization CVE-2024-37470 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 1, 2024
Woffice Core <= 5.4.8 - Reflected Cross-Site Scripting CVE-2024-37471 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 1, 2024
Defender Security <= 4.7.2 - Missing Authorization CVE-2024-37444 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N June 28, 2024
Newspack Blocks <= 3.0.8 - Missing Authorization CVE-2024-37425 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N June 28, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation