Wordfence Intelligence   >   Vulnerability Researchers   >   Yuki Haruma

Yuki Haruma

Organization: Tokyo Denki University, Faculty of Engineering, Department of Information and Communication Engineering, Cryptography Laboratory

81
All Time Ranking
32
All Time Discoveries

1 Achievement

Learn more about Achievements
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 22, 2024
Learn more Learn more about Achievements

Showing 1-20 of 32 Vulnerabilities

Branded Social Images <= 1.1.0 - Missing Authorization leading to Unauthenticated Plugin Settings Updates
5.3
CVE-2023-28536
Mar 20, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Event Manager for WooCommerce <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function
4.4
CVE-2023-28422
Mar 20, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Enhanced Plugin Admin <= 1.16 - Cross-Site Request Forgery via epa_options_page
5.4
CVE-2023-28618
Mar 21, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Mobile Banner <= 1.5 - Cross-Site Request Forgery leading to Plugin Settings Changes
4.3
CVE-2023-28930
Mar 29, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
a3 Portfolio <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2023-29097
Apr 10, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Captcha Them All <= 1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-30786
Apr 18, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
ApexChat <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
4.4
CVE-2023-28414
Apr 18, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Cab Grid <= 1.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-28533
Apr 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Woocommerce Email Report <= 2.4 - Unauthenticated Cross-Site Scripting
6.1
CVE-2023-27627
Apr 21, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Easy Slider Revolution <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter
6.4
CVE-2023-28622
Apr 21, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Dave's WordPress Live Search <= 4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-30876
Apr 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
GPS Plotter <= 5.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-30874
Apr 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
eRocket <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-28174
Apr 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Redirect After Login <= 0.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
4.4
CVE-2023-27624
Apr 21, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.0 - Missing Authorization via vg_display_data shortcode
6.5
CVE-2023-31073
Apr 24, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Woocommerce Tip/Donation <= 1.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings
5.5
CVE-2023-28783
Apr 24, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Easy Bet <= 1.0.2 - Authenticated(Contributor+) SQL Injection
8.8
CVE-2023-31092
Apr 26, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Logo Scheduler <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-30875
Apr 26, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Plugins List <= 2.5 - Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags
6.4
CVE-2023-31232
Apr 28, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CALL ME NOW <= 3.0 - Cross-Site Request Forgery
4.3
CVE-2023-32602
May 12, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Branded Social Images <= 1.1.0 - Missing Authorization leading to Unauthenticated Plugin Settings Updates CVE-2023-28536 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N March 20, 2023
Event Manager for WooCommerce <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function CVE-2023-28422 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N March 20, 2023
Enhanced Plugin Admin <= 1.16 - Cross-Site Request Forgery via epa_options_page CVE-2023-28618 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L March 21, 2023
Mobile Banner <= 1.5 - Cross-Site Request Forgery leading to Plugin Settings Changes CVE-2023-28930 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N March 29, 2023
a3 Portfolio <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2023-29097 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 10, 2023
Captcha Them All <= 1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-30786 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 18, 2023
ApexChat <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings CVE-2023-28414 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 18, 2023
Cab Grid <= 1.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-28533 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 21, 2023
Woocommerce Email Report <= 2.4 - Unauthenticated Cross-Site Scripting CVE-2023-27627 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 21, 2023
Easy Slider Revolution <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter CVE-2023-28622 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 21, 2023
Dave's WordPress Live Search <= 4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-30876 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 21, 2023
GPS Plotter <= 5.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-30874 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 21, 2023
eRocket <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-28174 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 21, 2023
Redirect After Login <= 0.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings CVE-2023-27624 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 21, 2023
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.0 - Missing Authorization via vg_display_data shortcode CVE-2023-31073 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N April 24, 2023
Woocommerce Tip/Donation <= 1.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings CVE-2023-28783 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N April 24, 2023
Easy Bet <= 1.0.2 - Authenticated(Contributor+) SQL Injection CVE-2023-31092 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H April 26, 2023
Logo Scheduler <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-30875 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N April 26, 2023
Plugins List <= 2.5 - Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags CVE-2023-31232 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 28, 2023
CALL ME NOW <= 3.0 - Cross-Site Request Forgery CVE-2023-32602 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N May 12, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation