Wordfence Intelligence   >   Vulnerability Researchers   >   tiborisaak

tiborisaak

511
All Time Ranking
7
All Time Discoveries
1
90 Day Published Submissions
23 Jun '26
Last Published Submission

About

Security researcher and sound engineer

5 Achievements

Learn more about Achievements
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
December 17, 2025
Submitted SQLi Vulnerability
Submitted SQLi Vulnerability
July 30, 2025
Resourceful Researcher
Resourceful Researcher
January 28, 2025
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
July 30, 2024
Learn more Learn more about Achievements

7 Vulnerabilities

Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
8.8
CVE-2026-7761
Jun 23, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
6.4
CVE-2025-15064
Apr 3, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
6.4
CVE-2025-13217
Dec 16, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion
6.5
CVE-2025-0818
Aug 12, 2025
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
5.3
CVE-2024-12276
Feb 20, 2025
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
4.3
CVE-2024-10528
Nov 20, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
5.4
CVE-2024-2765
Apr 10, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure CVE-2026-7761 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H June 23, 2026
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets CVE-2025-15064 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 3, 2026
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' CVE-2025-13217 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 16, 2025
Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion CVE-2025-0818 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L August 12, 2025
Ultimate Member <= 2.9.2 - Authenticated SQL Injection CVE-2024-12276 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N February 20, 2025
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update CVE-2024-10528 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N November 20, 2024
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-2765 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N April 10, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation