Wordfence Intelligence   >   Vulnerability Researchers   >   Rafshanzani Suhada

Rafshanzani Suhada

33
All Time Ranking
93
All Time Discoveries

2 Achievements

Learn more about Achievements
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 4, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
November 30, 2023
Learn more Learn more about Achievements

Showing 61-80 of 93 Vulnerabilities

Easy Table of Contents <= 2.0.45.2 - Missing Authorization via eztoc_reset_options_to_default
5.4
CVE-2023-25469
Mar 21, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Site Reviews <= 6.5.1 - Missing Authorization
5.4
CVE-2023-27625
Mar 13, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
GiveWP <= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion
5.4
CVE-2023-23672
Mar 10, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
RegistrationMagic <= 5.1.9.2 - Cross-Site Request Forgery leading to Form Metadata Deletion
5.4
CVE-2023-25991
Feb 17, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
ChatBot <= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset
5.4
CVE-2023-24415
Jan 27, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Manage Notification E-mails <= 1.8.5 - Missing Authorization
5.3
CVE-2023-6496
Dec 8, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Email posts to subscribers <= 6.2 - Missing Authorization to Sensitive Information Exposure
5.3
CVE-2023-41735
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
User Registration <= 2.3.2.1 - Missing Authorization via send_test_email
5.3
CVE-2023-29429
Apr 6, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
WordPress Social Login and Register <= 7.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
5.3
CVE-2023-25455
Feb 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Disable User Login <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update
5.3
CVE-2022-2350
Sep 14, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
4.9
CVE-2023-6624
Dec 11, 2023
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-6594
Jan 8, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Email posts to subscribers <= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-41736
Sep 5, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Klaviyo <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-0874
Mar 20, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
KB Support <= 1.5.84 - Authenticated (Subscriber+) CSV Injection
4.4
CVE-2023-25983
Feb 24, 2023
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting
4.4
CVE-2022-47613
Jan 27, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save
4.3
CVE-2023-6493
Jan 4, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions
4.3
CVE-2023-47557
Nov 7, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Popup by Supsystic <= 1.10.19 - Missing Authorization to Sensitive Information Exposure
4.3
CVE-2023-46197
Oct 18, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Super Socializer <= 7.13.54 - Cross-Site Request Forgery
4.3
CVE-2023-41802
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Easy Table of Contents <= 2.0.45.2 - Missing Authorization via eztoc_reset_options_to_default CVE-2023-25469 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N March 21, 2023
Site Reviews <= 6.5.1 - Missing Authorization CVE-2023-27625 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N March 13, 2023
GiveWP <= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion CVE-2023-23672 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L March 10, 2023
RegistrationMagic <= 5.1.9.2 - Cross-Site Request Forgery leading to Form Metadata Deletion CVE-2023-25991 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L February 17, 2023
ChatBot <= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset CVE-2023-24415 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N January 27, 2023
Manage Notification E-mails <= 1.8.5 - Missing Authorization CVE-2023-6496 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 8, 2023
Email posts to subscribers <= 6.2 - Missing Authorization to Sensitive Information Exposure CVE-2023-41735 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N September 5, 2023
User Registration <= 2.3.2.1 - Missing Authorization via send_test_email CVE-2023-29429 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 6, 2023
WordPress Social Login and Register <= 7.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion CVE-2023-25455 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N February 13, 2023
Disable User Login <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update CVE-2022-2350 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N September 14, 2022
Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode CVE-2023-6624 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N December 11, 2023
WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-6594 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N January 8, 2024
Email posts to subscribers <= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-41736 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N September 5, 2023
Klaviyo <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-0874 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N March 20, 2023
KB Support <= 1.5.84 - Authenticated (Subscriber+) CSV Injection CVE-2023-25983 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N February 24, 2023
ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting CVE-2022-47613 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N January 27, 2023
Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save CVE-2023-6493 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 4, 2024
Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions CVE-2023-47557 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N November 7, 2023
Popup by Supsystic <= 1.10.19 - Missing Authorization to Sensitive Information Exposure CVE-2023-46197 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N October 18, 2023
Super Socializer <= 7.13.54 - Cross-Site Request Forgery CVE-2023-41802 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 5, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation