Wordfence Intelligence   >   Vulnerability Researchers   >   thiennv

thiennv

21
All Time Ranking
121
All Time Discoveries

Showing 41-60 of 121 Vulnerabilities

Ultimate Taxonomy Manager <= 2.0 - Unauthenticated Cross-Site Scripting
6.1
CVE-2023-45837
Oct 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
XYDAC Ultimate Taxonomy Manager <= 2.0 - Cross-Site Request Forgery
4.3
CVE-2023-45836
Oct 13, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Proofreading <= 1.1 - Reflected Cross-Site Scripting
6.1
CVE-2023-45772
Oct 12, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Responsive Image Gallery, Gallery Album <= 2.0.3 - Missing Authorization via Multiple AJAX Actions
5.4
CVE-2023-45631
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Responsive Image Gallery, Gallery Album <= 2.0.3 - Unauthenticated Cross-Site Scripting
6.1
CVE-2023-45630
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Responsive Image Gallery, Gallery Album <= 2.0.3 - Cross-Site Request Forgery
5.4
CVE-2023-45629
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Feed Statistics <= 4.1 - Cross-Site Request Forgery via init
4.3
CVE-2023-45605
Oct 11, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Download canvasio3D Light <= 2.5.0 - Reflected Cross-Site Scripting
6.1
CVE-2023-45062
Oct 3, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Cooked <= 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-44477
Sep 29, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval
4.3
CVE-2023-44149
Sep 22, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Legal Pages <= 1.3.7 - Missing Authorization on 'deleteLegalTemplate'
4.3
CVE-2023-50886
Sep 18, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization via export_settings
4.3
CVE-2023-41951
Sep 6, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Click To Tweet <= 2.0.14 - Missing Authorization
4.3
CVE-2023-41857
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WP Accessibility Helper (WAH) <= 0.6.2.4 - Missing Authorization via AJAX action
4.3
CVE-2023-41869
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Click To Tweet <= 2.0.14 - Reflected Cross-Site Scripting
6.1
CVE-2023-41856
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Restrict <= 2.2.4 - Reflected Cross-Site Scripting
6.1
CVE-2023-41861
Sep 5, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Ovic Product Bundle <= 1.1.2 - Missing Authorization
5.3
CVE-2023-41649
Sep 1, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
WP Bannerize Pro <= 1.6.9 - Reflected Cross-Site Scripting
6.1
CVE-2023-41663
Sep 1, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Pricing Deals for WooCommerce <= 2.0.3.2 - Missing Authorization via vtprd_ajax_clone_rule
5.3
CVE-2023-41240
Aug 29, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Donations Made Easy – Smart Donations <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2023-40664
Aug 18, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Ultimate Taxonomy Manager <= 2.0 - Unauthenticated Cross-Site Scripting CVE-2023-45837 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 13, 2023
XYDAC Ultimate Taxonomy Manager <= 2.0 - Cross-Site Request Forgery CVE-2023-45836 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 13, 2023
Proofreading <= 1.1 - Reflected Cross-Site Scripting CVE-2023-45772 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 12, 2023
Responsive Image Gallery, Gallery Album <= 2.0.3 - Missing Authorization via Multiple AJAX Actions CVE-2023-45631 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L October 11, 2023
Responsive Image Gallery, Gallery Album <= 2.0.3 - Unauthenticated Cross-Site Scripting CVE-2023-45630 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 11, 2023
Responsive Image Gallery, Gallery Album <= 2.0.3 - Cross-Site Request Forgery CVE-2023-45629 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L October 11, 2023
Feed Statistics <= 4.1 - Cross-Site Request Forgery via init CVE-2023-45605 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 11, 2023
Download canvasio3D Light <= 2.5.0 - Reflected Cross-Site Scripting CVE-2023-45062 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 3, 2023
Cooked <= 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-44477 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N September 29, 2023
Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval CVE-2023-44149 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 22, 2023
Legal Pages <= 1.3.7 - Missing Authorization on 'deleteLegalTemplate' CVE-2023-50886 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 18, 2023
rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization via export_settings CVE-2023-41951 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 6, 2023
Click To Tweet <= 2.0.14 - Missing Authorization CVE-2023-41857 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 5, 2023
WP Accessibility Helper (WAH) <= 0.6.2.4 - Missing Authorization via AJAX action CVE-2023-41869 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 5, 2023
Click To Tweet <= 2.0.14 - Reflected Cross-Site Scripting CVE-2023-41856 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N September 5, 2023
Restrict <= 2.2.4 - Reflected Cross-Site Scripting CVE-2023-41861 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N September 5, 2023
Ovic Product Bundle <= 1.1.2 - Missing Authorization CVE-2023-41649 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N September 1, 2023
WP Bannerize Pro <= 1.6.9 - Reflected Cross-Site Scripting CVE-2023-41663 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N September 1, 2023
Pricing Deals for WooCommerce <= 2.0.3.2 - Missing Authorization via vtprd_ajax_clone_rule CVE-2023-41240 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N August 29, 2023
Donations Made Easy – Smart Donations <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting CVE-2023-40664 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N August 18, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation