Wordfence Intelligence   >   Vulnerability Researchers   >   beluga

beluga

52
All Time Ranking
60
All Time Discoveries

Showing 1-20 of 60 Vulnerabilities

WP Dummy Content Generator <= 3.2.1 - Unauthenticated Code Injection
10.0
CVE-2024-32599
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
WP Travel Engine <= 5.7.9 - Unauthenticated SQL Injection
10.0
CVE-2024-30502
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.2 - Authenticated (Subscriber+) Remote Code Execution
9.9
CVE-2024-32680
Apr 17, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Poll Maker <= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-32514
Apr 15, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
WordPress Tooltips <= 9.4.3 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-30243
Mar 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Product Designer <= 1.0.32 - Unauthenticated PHP Object Injection
9.8
CVE-2024-31277
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ERE Recently Viewed <= 1.3 - Unauthenticated PHP Object Injection
9.8
CVE-2024-24797
Jan 31, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks <= 3.1.4 - PHP Object Injection via wopb_wishlist and wopb_compare
9.8
CVE-2024-23512
Jan 30, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
9.3
CVE-2024-32830
Apr 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
WP Travel Engine <= 5.7.9 - Authenticated (Administrator+) SQL Injection
9.1
CVE-2024-30504
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
WP Poll Maker <= 3.1 - Authenticated (Subscriber+) Arbitrary File Deletion
8.8
CVE-2024-31240
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SP Project & Document Manager <= 4.69 - Authenticated (Contributor+) SQL Injection via Shortcode
8.8
CVE-2024-24868
Feb 2, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Delhivery Logistics Courier <= 1.0.107 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2024-22283
Jan 16, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PropertyHive <= 2.0.5 - Unauthenticated PHP Object Injection via propertyhive_currency
8.1
CVE-2024-23513
Jan 30, 2024
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Conversational Forms for ChatBot <= 1.1.8 - Unauthenticated Arbitrary File Download
7.5
CVE-2024-32729
Apr 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Total Upkeep <= 1.15.8 - Improper Authorization to Unauthenticated Arbitrary File Download
7.5
CVE-2024-24869
Feb 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Sendinblue for WooCommerce <= 4.0.17 - Authenticated (Editor+) Arbitrary File Download and Deletion
7.2
CVE-2024-32807
Apr 22, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.7 - Reflected Cross-Site Scripting
7.2
CVE-2024-32567
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Shield Security <= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page
7.2
CVE-2024-22163
Jan 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
PDF Invoices & Packing Slips for WooCommerce <= 3.7.6 - Authenticated (Shop Manager+) SQL Injection
7.2
CVE-2024-22147
Jan 12, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
WP Dummy Content Generator <= 3.2.1 - Unauthenticated Code Injection CVE-2024-32599 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H April 16, 2024
WP Travel Engine <= 5.7.9 - Unauthenticated SQL Injection CVE-2024-30502 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H March 28, 2024
HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.2 - Authenticated (Subscriber+) Remote Code Execution CVE-2024-32680 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H April 17, 2024
Poll Maker <= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-32514 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H April 15, 2024
WordPress Tooltips <= 9.4.3 - Authenticated (Contributor+) SQL Injection CVE-2024-30243 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H March 26, 2024
Product Designer <= 1.0.32 - Unauthenticated PHP Object Injection CVE-2024-31277 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H April 5, 2024
ERE Recently Viewed <= 1.3 - Unauthenticated PHP Object Injection CVE-2024-24797 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 31, 2024
ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks <= 3.1.4 - PHP Object Injection via wopb_wishlist and wopb_compare CVE-2024-23512 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 30, 2024
BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery CVE-2024-32830 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N April 22, 2024
WP Travel Engine <= 5.7.9 - Authenticated (Administrator+) SQL Injection CVE-2024-30504 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H March 28, 2024
WP Poll Maker <= 3.1 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2024-31240 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H April 5, 2024
SP Project & Document Manager <= 4.69 - Authenticated (Contributor+) SQL Injection via Shortcode CVE-2024-24868 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H February 2, 2024
Delhivery Logistics Courier <= 1.0.107 - Authenticated (Subscriber+) SQL Injection CVE-2024-22283 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 16, 2024
PropertyHive <= 2.0.5 - Unauthenticated PHP Object Injection via propertyhive_currency CVE-2024-23513 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H January 30, 2024
Conversational Forms for ChatBot <= 1.1.8 - Unauthenticated Arbitrary File Download CVE-2024-32729 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N April 22, 2024
Total Upkeep <= 1.15.8 - Improper Authorization to Unauthenticated Arbitrary File Download CVE-2024-24869 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N February 2, 2024
Sendinblue for WooCommerce <= 4.0.17 - Authenticated (Editor+) Arbitrary File Download and Deletion CVE-2024-32807 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H April 22, 2024
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.7 - Reflected Cross-Site Scripting CVE-2024-32567 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N April 16, 2024
Shield Security <= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page CVE-2024-22163 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N January 16, 2024
PDF Invoices & Packing Slips for WooCommerce <= 3.7.6 - Authenticated (Shop Manager+) SQL Injection CVE-2024-22147 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H January 12, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation