Wordfence Intelligence   >   Vulnerability Researchers   >   Muhammad Yudha - DJ

Muhammad Yudha - DJ

7
All Time Ranking
710
All Time Discoveries
42
90 Day Published Submissions
10 Jul '26
Last Published Submission

About

A former blogger turned security researcher. After nearly a decade of writing, I explored other fields and discovered security research. I never expected to enjoy it more than blogging, but I do. I love the constant opportunity to learn something new every day.

PS (Nov 2025): Over a year since starting in Sept 2024. Really enjoying bug bounty hunting. I learned a lot. Thanks to Wordfence for making it possible.

13 Achievements

Learn more about Achievements
Submitted 300 Vulnerabilities
Submitted 300 Vulnerabilities
April 15, 2026
Submitted 200 Vulnerabilities
Submitted 200 Vulnerabilities
December 5, 2025
Resourceful Researcher
Resourceful Researcher
November 12, 2025
Submitted LFI Vulnerability
Submitted LFI Vulnerability
September 30, 2025
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
August 4, 2025
Submitted SQLi Vulnerability
Submitted SQLi Vulnerability
July 30, 2025
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
June 20, 2025
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
May 2, 2025
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
January 16, 2025
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
December 17, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
December 13, 2024
Submitted XSS Vulnerability
Submitted XSS Vulnerability
December 5, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
September 30, 2024
Learn more Learn more about Achievements

Showing 1-20 of 710 Vulnerabilities

Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute
6.4
CVE-2026-5743
Jul 10, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode
6.4
CVE-2026-3907
Jul 9, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute
6.4
CVE-2026-6740
Jul 7, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields
6.4
CVE-2026-8892
Jul 2, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
6.4
CVE-2026-10095
Jun 30, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode
6.4
CVE-2026-2387
Jun 30, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode
6.4
CVE-2026-12135
Jun 30, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
BNE Testimonials <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-68075
Jun 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Image Carousel <= 1.0.0.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-68074
Jun 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Featured Image <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-57431
Jun 25, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute
6.4
CVE-2026-9620
Jun 23, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute
6.4
CVE-2026-9629
Jun 12, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
kk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-8895
Jun 8, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Global Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-8883
Jun 8, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Express Payment For Stripe <= 1.28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-8893
Jun 5, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
6.4
CVE-2026-9714
May 28, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting
6.4
CVE-2026-4334
May 27, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-9644
May 27, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-2030
May 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization
6.4
CVE-2026-3897
May 26, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute CVE-2026-5743 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 10, 2026
Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode CVE-2026-3907 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 9, 2026
Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute CVE-2026-6740 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 7, 2026
CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields CVE-2026-8892 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 2, 2026
WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute CVE-2026-10095 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 30, 2026
Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode CVE-2026-2387 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 30, 2026
FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode CVE-2026-12135 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 30, 2026
BNE Testimonials <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-68075 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 26, 2026
Image Carousel <= 1.0.0.41 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-68074 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 26, 2026
Featured Image <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-57431 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 25, 2026
WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute CVE-2026-9620 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 23, 2026
Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute CVE-2026-9629 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 12, 2026
kk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-8895 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 8, 2026
Global Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-8883 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 8, 2026
Express Payment For Stripe <= 1.28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-8893 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N June 5, 2026
Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute CVE-2026-9714 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 28, 2026
Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting CVE-2026-4334 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 27, 2026
LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-9644 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 27, 2026
WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-2030 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 26, 2026
Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization CVE-2026-3897 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N May 26, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation