Wordfence Intelligence   >   Vulnerability Researchers   >   stealthcopter

stealthcopter

7
All Time Ranking
412
All Time Discoveries
15
90 Day Published Submissions
17 Jan '25
Last Published Submission

10 Achievements

Learn more about Achievements
Submitted 200 Vulnerabilities
Submitted 200 Vulnerabilities
October 16, 2024
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
June 5, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
May 21, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
May 9, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
April 19, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
April 18, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
March 8, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
February 20, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 22, 2024
Learn more Learn more about Achievements

Showing 1-20 of 412 Vulnerabilities

The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module
7.5
CVE-2024-13184
Jan 17, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter
6.4
CVE-2025-0369
Jan 17, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
6.1
CVE-2025-0393
Jan 13, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2024-12848
Jan 8, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution
8.8
CVE-2024-11816
Jan 7, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
StorePress <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-22821
Jan 7, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Power Mag <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-22816
Jan 7, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
BVD Easy Gallery Manager <= 1.0.6 - Reflected Cross-Site Scripting
6.1
CVE-2025-22353
Jan 3, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Digi Store <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-22354
Jan 3, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Post/Page Copying Tool <= 2.0.0 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-56300
Jan 3, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NewsDaily <= 1.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-56208
Dec 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Barter <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-54346
Dec 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
hmd <= 2.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-54350
Dec 14, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CoSchool LMS <= 1.2 - Missing Authorization to Privilege Escalation
9.8
CVE-2024-54296
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vBSSO-lite <= 1.4.3 - Missing Authorization to Privilege Escalation
9.8
CVE-2024-54297
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Projectopia <= 5.1.7 - Missing Authorization to Privilege Escalation via pto_reset_password()
9.8
CVE-2024-54336
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
9.8
CVE-2024-10124
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Firebase OTP Authentication <= 1.0.1 - Missing Authorization to Privilege Escalation
9.8
CVE-2024-54294
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation
9.8
CVE-2024-54295
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation
9.8
CVE-2024-54369
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module CVE-2024-13184 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N January 17, 2025
Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter CVE-2025-0369 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 17, 2025
Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting CVE-2025-0393 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 13, 2025
SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-12848 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 8, 2025
The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution CVE-2024-11816 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 7, 2025
StorePress <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-22821 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 7, 2025
Power Mag <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-22816 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 7, 2025
BVD Easy Gallery Manager <= 1.0.6 - Reflected Cross-Site Scripting CVE-2025-22353 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 3, 2025
Digi Store <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-22354 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 3, 2025
Post/Page Copying Tool <= 2.0.0 - Unauthenticated Sensitive Information Exposure CVE-2024-56300 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N January 3, 2025
NewsDaily <= 1.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-56208 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 19, 2024
Barter <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-54346 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 19, 2024
hmd <= 2.0 - Reflected Cross-Site Scripting CVE-2024-54350 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N December 14, 2024
CoSchool LMS <= 1.2 - Missing Authorization to Privilege Escalation CVE-2024-54296 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2024
vBSSO-lite <= 1.4.3 - Missing Authorization to Privilege Escalation CVE-2024-54297 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2024
Projectopia <= 5.1.7 - Missing Authorization to Privilege Escalation via pto_reset_password() CVE-2024-54336 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2024
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation CVE-2024-10124 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2024
Firebase OTP Authentication <= 1.0.1 - Missing Authorization to Privilege Escalation CVE-2024-54294 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2024
ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation CVE-2024-54295 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2024
Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation CVE-2024-54369 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation