Wordfence Intelligence   >   Vulnerability Researchers   >   wesley (wcraft)

wesley (wcraft)

21
All Time Ranking
342
All Time Discoveries
4
90 Day Published Submissions
8 Jul '26
Last Published Submission

13 Achievements

Learn more about Achievements
Resourceful Researcher
Resourceful Researcher
July 25, 2026
Submitted LFI Vulnerability
Submitted LFI Vulnerability
September 30, 2025
Submitted 300 Vulnerabilities
Submitted 300 Vulnerabilities
August 14, 2025
Submitted SQLi Vulnerability
Submitted SQLi Vulnerability
July 30, 2025
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 200 Vulnerabilities
Submitted 200 Vulnerabilities
August 5, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
May 6, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
April 9, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 21, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 29, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
February 12, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 17, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 17, 2024
Learn more Learn more about Achievements

Showing 1-20 of 342 Vulnerabilities

Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint
8.8
CVE-2026-4275
Jul 8, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
4.3
CVE-2026-5137
Jul 2, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
6.5
CVE-2026-5149
Jun 15, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
7.5
CVE-2026-3018
Jun 9, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
7.5
CVE-2026-5032
Apr 1, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2025-13910
Mar 20, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP
8.1
CVE-2025-14002
Dec 15, 2025
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover
8.1
CVE-2025-13820
Dec 11, 2025
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection
8.1
CVE-2025-9501
Oct 27, 2025
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
8.8
CVE-2025-8593
Oct 10, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation
2.4
CVE-2025-8606
Oct 10, 2025
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
9.8
CVE-2025-7634
Oct 8, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
9.8
CVE-2025-7526
Oct 8, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
8.8
CVE-2025-7052
Sep 29, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
8.2
CVE-2025-7038
Sep 29, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
5.4
CVE-2025-8487
Sep 18, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation
8.1
CVE-2025-8565
Sep 17, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
4.3
CVE-2025-8446
Sep 15, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery
4.3
CVE-2025-8481
Sep 10, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Zoho Flow <= 2.14.1 - Cross-Site Request Forgery
4.3
CVE-2025-8479
Sep 10, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint CVE-2026-4275 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H July 8, 2026
RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter CVE-2026-5137 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N July 2, 2026
RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter CVE-2026-5149 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N June 15, 2026
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter CVE-2026-3018 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N June 9, 2026
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header CVE-2026-5032 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N April 1, 2026
WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting CVE-2025-13910 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 20, 2026
WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP CVE-2025-14002 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H December 15, 2025
Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover CVE-2025-13820 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H December 11, 2025
W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection CVE-2025-9501 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H October 27, 2025
GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation CVE-2025-8593 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H October 10, 2025
GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation CVE-2025-8606 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N October 10, 2025
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion CVE-2025-7634 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H October 8, 2025
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming CVE-2025-7526 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H October 8, 2025
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function CVE-2025-7052 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H September 29, 2025
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function CVE-2025-7038 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N September 29, 2025
Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation CVE-2025-8487 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L September 18, 2025
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation CVE-2025-8565 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H September 17, 2025
Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install CVE-2025-8446 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 15, 2025
Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery CVE-2025-8481 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 10, 2025
Zoho Flow <= 2.14.1 - Cross-Site Request Forgery CVE-2025-8479 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N September 10, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation