Wordfence Intelligence   >   Vulnerability Researchers   >   beluga

beluga

53
All Time Ranking
53
All Time Discoveries

Showing 1-20 of 53 Vulnerabilities

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.2 - Authenticated (Subscriber+) Remote Code Execution
9.9
CVE-2024-32680
Apr 17, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.7 - Reflected Cross-Site Scripting
7.2
CVE-2024-32567
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Import Content in WordPress & WooCommerce with Excel <= 4.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-32585
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EnvíaloSimple: Email Marketing y Newsletters <= 2.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-32587
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Support Genix <= 1.2.3 - Missing Authorization
5.3
CVE-2023-49742
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
WP Dummy Content Generator <= 3.2.1 - Unauthenticated Code Injection
10.0
CVE-2024-32599
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
WP File Download Light <= 1.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-32539
Apr 15, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More <= 13.3.1 - Sensitive Information Exposure via Log Files
5.3
CVE-2024-32513
Apr 15, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Poll Maker <= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-32514
Apr 15, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Amelia <= 1.0.95 - Cross-Site Request Forgery
4.3
CVE-2024-31425
Apr 10, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
App Builder <= 3.8.7 - Open Redirection
5.4
CVE-2024-31282
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
WP Poll Maker <= 3.1 - Authenticated (Subscriber+) Arbitrary File Deletion
8.8
CVE-2024-31240
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10.1 - Unauthenticated Arbitrary File Download
5.3
CVE-2024-31343
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ARForms Form Builder <= 1.6.1 - Cross-Site Request Forgery
4.3
CVE-2024-31272
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
ARForms Form Builder <= 1.6.1 - Missing Authorization
4.3
CVE-2024-31270
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Product Designer <= 1.0.32 - Unauthenticated PHP Object Injection
9.8
CVE-2024-31277
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FG Drupal to WordPress <= 3.70.3 - Sensitive Information Exposure
5.3
CVE-2024-31247
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Kanban Boards for WordPress <= 2.5.21 - Reflected Cross-Site Scripting
6.1
CVE-2024-31103
Mar 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
FG PrestaShop to WooCommerce <= 4.45.1 - Unauthenticated Sensitive Information Disclosure
5.3
CVE-2024-30511
Mar 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
User Rights Access Manager <= 1.1.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-31122
Mar 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.2 - Authenticated (Subscriber+) Remote Code Execution CVE-2024-32680 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H April 17, 2024
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.7 - Reflected Cross-Site Scripting CVE-2024-32567 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N April 16, 2024
Import Content in WordPress & WooCommerce with Excel <= 4.2 - Reflected Cross-Site Scripting CVE-2024-32585 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 16, 2024
EnvíaloSimple: Email Marketing y Newsletters <= 2.2 - Reflected Cross-Site Scripting CVE-2024-32587 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 16, 2024
Support Genix <= 1.2.3 - Missing Authorization CVE-2023-49742 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 16, 2024
WP Dummy Content Generator <= 3.2.1 - Unauthenticated Code Injection CVE-2024-32599 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H April 16, 2024
WP File Download Light <= 1.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-32539 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 15, 2024
Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More <= 13.3.1 - Sensitive Information Exposure via Log Files CVE-2024-32513 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 15, 2024
Poll Maker <= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-32514 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H April 15, 2024
Amelia <= 1.0.95 - Cross-Site Request Forgery CVE-2024-31425 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 10, 2024
App Builder <= 3.8.7 - Open Redirection CVE-2024-31282 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N April 5, 2024
WP Poll Maker <= 3.1 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2024-31240 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H April 5, 2024
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10.1 - Unauthenticated Arbitrary File Download CVE-2024-31343 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 5, 2024
ARForms Form Builder <= 1.6.1 - Cross-Site Request Forgery CVE-2024-31272 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 5, 2024
ARForms Form Builder <= 1.6.1 - Missing Authorization CVE-2024-31270 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N April 5, 2024
Product Designer <= 1.0.32 - Unauthenticated PHP Object Injection CVE-2024-31277 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H April 5, 2024
FG Drupal to WordPress <= 3.70.3 - Sensitive Information Exposure CVE-2024-31247 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 5, 2024
Kanban Boards for WordPress <= 2.5.21 - Reflected Cross-Site Scripting CVE-2024-31103 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 29, 2024
FG PrestaShop to WooCommerce <= 4.45.1 - Unauthenticated Sensitive Information Disclosure CVE-2024-30511 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N March 29, 2024
User Rights Access Manager <= 1.1.2 - Reflected Cross-Site Scripting CVE-2024-31122 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 29, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation