Wordfence Intelligence   >   Vulnerability Researchers   >   thiennv

thiennv

21
All Time Ranking
124
All Time Discoveries

Showing 101-120 of 124 Vulnerabilities

WOLF <= 1.0.7.1 - Cross-Site Request Forgery
4.3
CVE-2023-46152
Oct 17, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Who Hit The Page – Hit Counter <= 1.4.14.3 - Cross-Site Request Forgery
4.3
CVE-2023-46087
Oct 16, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
ApplyOnline – Application Form Builder and Manager <= 2.5.2 - Missing Authorization
4.3
CVE-2023-46080
Oct 16, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
XYDAC Ultimate Taxonomy Manager <= 2.0 - Cross-Site Request Forgery
4.3
CVE-2023-45836
Oct 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Feed Statistics <= 4.1 - Cross-Site Request Forgery via init
4.3
CVE-2023-45605
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval
4.3
CVE-2023-44149
Sep 22, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Legal Pages <= 1.3.7 - Missing Authorization on 'deleteLegalTemplate'
4.3
CVE-2023-50886
Sep 18, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization via export_settings
4.3
CVE-2023-41951
Sep 6, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Click To Tweet <= 2.0.14 - Missing Authorization
4.3
CVE-2023-41857
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WP Accessibility Helper (WAH) <= 0.6.2.4 - Missing Authorization via AJAX action
4.3
CVE-2023-41869
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Video Gallery & Management <= 3.3.5 - Cross-Site Request Forgery
4.3
CVE-2023-40558
Aug 16, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
YITH WooCommerce Waiting List <= 2.6.0 - Cross-Site Request forgery via 'save_mail_status'
4.3
CVE-2023-36506
Aug 10, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Google Map Shortcode <= 3.1.2 - Cross-Site Request Forgery to Plugin Setting Update
4.3
CVE-2023-38396
Jul 24, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
GTmetrix for WordPress <= 0.4.7 - Cross-Site Request Forgery
4.3
CVE-2023-37996
Jul 19, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
bbPress Toolkit <= 1.0.12 - Cross-Site Request Forgery
4.3
CVE-2023-34031
May 31, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WOLF <= 1.0.7 - Cross-Site Request Forgery via create_profile
4.3
CVE-2023-34028
May 29, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Jazz Popups <= 1.8.7 - Cross-Site Request Forgery
4.3
CVE-2023-32966
May 18, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Front End Users <= 3.2.24 - Cross-Site Request Forgery
4.3
CVE-2023-34005
Apr 7, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
I Recommend This <= 3.9.0 - Cross-Site Request Forgery
4.3
CVE-2023-28696
Mar 22, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
LiteSpeed Cache <= 5.3 - Missing Authorization to Toggle Crawler State
4.3
CVE-2022-46800
Mar 22, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
WOLF <= 1.0.7.1 - Cross-Site Request Forgery CVE-2023-46152 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 17, 2023
Who Hit The Page – Hit Counter <= 1.4.14.3 - Cross-Site Request Forgery CVE-2023-46087 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 16, 2023
ApplyOnline – Application Form Builder and Manager <= 2.5.2 - Missing Authorization CVE-2023-46080 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N October 16, 2023
XYDAC Ultimate Taxonomy Manager <= 2.0 - Cross-Site Request Forgery CVE-2023-45836 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 13, 2023
Feed Statistics <= 4.1 - Cross-Site Request Forgery via init CVE-2023-45605 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 11, 2023
Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval CVE-2023-44149 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 22, 2023
Legal Pages <= 1.3.7 - Missing Authorization on 'deleteLegalTemplate' CVE-2023-50886 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 18, 2023
rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization via export_settings CVE-2023-41951 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 6, 2023
Click To Tweet <= 2.0.14 - Missing Authorization CVE-2023-41857 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 5, 2023
WP Accessibility Helper (WAH) <= 0.6.2.4 - Missing Authorization via AJAX action CVE-2023-41869 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 5, 2023
Video Gallery & Management <= 3.3.5 - Cross-Site Request Forgery CVE-2023-40558 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 16, 2023
YITH WooCommerce Waiting List <= 2.6.0 - Cross-Site Request forgery via 'save_mail_status' CVE-2023-36506 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 10, 2023
Google Map Shortcode <= 3.1.2 - Cross-Site Request Forgery to Plugin Setting Update CVE-2023-38396 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 24, 2023
GTmetrix for WordPress <= 0.4.7 - Cross-Site Request Forgery CVE-2023-37996 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 19, 2023
bbPress Toolkit <= 1.0.12 - Cross-Site Request Forgery CVE-2023-34031 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N May 31, 2023
WOLF <= 1.0.7 - Cross-Site Request Forgery via create_profile CVE-2023-34028 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N May 29, 2023
Jazz Popups <= 1.8.7 - Cross-Site Request Forgery CVE-2023-32966 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N May 18, 2023
Front End Users <= 3.2.24 - Cross-Site Request Forgery CVE-2023-34005 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 7, 2023
I Recommend This <= 3.9.0 - Cross-Site Request Forgery CVE-2023-28696 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N March 22, 2023
LiteSpeed Cache <= 5.3 - Missing Authorization to Toggle Crawler State CVE-2022-46800 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 22, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation