🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Abdi Pranata

Abdi Pranata

All Time Ranking

300

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

Showing 241-260 of 300 Vulnerabilities

Booster Elementor Addons <= 1.4.9 - Missing Authorization

6.5

CVE-2023-38480

Jul 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Instant CSS <= 1.1.4 - Missing Authorization via AJAX Actions

5.3

CVE-2023-38483

Jul 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Post to Google My Business <= 3.1.14 - Cross-Site Request Forgery to Dismiss Notification

4.3

CVE-2023-41689

Jul 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Language <= 1.2.1 - Missing Authorization

4.3

CVE-2023-38383

Jul 20, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

WP Emoji One <= 0.6.0 - Cross-Site Request Forgery

4.3

CVE-2023-37991

Jul 19, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints

7.3

CVE-2023-32117

Jul 12, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

DirectoryPress <= 3.6.2 - Missing Authorization

7.3

CVE-2023-37967

Jul 12, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

MF Gig Calendar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time

6.4

CVE-2023-37970

Jul 12, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Yet Another Stars Rating <= 3.3.8 - Missing Authorization to Vote Tampering

5.3

CVE-2023-37867

Jul 10, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Video Gallery <= 1.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-25477

Jul 7, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Image Regenerate & Select Crop <= 7.1.0 - Missing Authorization

5.4

CVE-2023-36680

Jul 4, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Cryptocurrency Widgets – Price Ticker & Coins List <= 2.6.2 - Missing Authorization

5.3

CVE-2023-36681

Jul 4, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Kingkong Board <= 2.1.0.2 - Missing Authorization

6.3

CVE-2023-36694

Jul 4, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Sublanguage <= 2.9 - Missing Authorization

5.4

CVE-2023-36695

Jul 4, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Mobile Call Now & Map Buttons <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-24401

Jul 4, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.68 - Missing Authorization via activate_addon

4.3

CVE-2023-36531

Jun 28, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

BBS e-Popup <= 2.4.5 - Missing Authorization

5.3

CVE-2023-36504

Jun 23, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

ReDi Restaurant Reservation <= 23.0211 - Missing Authorization

5.3

CVE-2023-36510

Jun 22, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Sermon'e <= 1.0.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-35776

Jun 19, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Sermon'e <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-35776

Jun 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Booster Elementor Addons <= 1.4.9 - Missing Authorization	CVE-2023-38480	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	July 24, 2023
Instant CSS <= 1.1.4 - Missing Authorization via AJAX Actions	CVE-2023-38483	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 24, 2023
Post to Google My Business <= 3.1.14 - Cross-Site Request Forgery to Dismiss Notification	CVE-2023-41689	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 24, 2023
Language <= 1.2.1 - Missing Authorization	CVE-2023-38383	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	July 20, 2023
WP Emoji One <= 0.6.0 - Cross-Site Request Forgery	CVE-2023-37991	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 19, 2023
Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints	CVE-2023-32117	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	July 12, 2023
DirectoryPress <= 3.6.2 - Missing Authorization	CVE-2023-37967	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	July 12, 2023
MF Gig Calendar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time	CVE-2023-37970	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 12, 2023
Yet Another Stars Rating <= 3.3.8 - Missing Authorization to Vote Tampering	CVE-2023-37867	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 10, 2023
Video Gallery <= 1.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-25477	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	July 7, 2023
Image Regenerate & Select Crop <= 7.1.0 - Missing Authorization	CVE-2023-36680	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	July 4, 2023
Cryptocurrency Widgets – Price Ticker & Coins List <= 2.6.2 - Missing Authorization	CVE-2023-36681	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 4, 2023
Kingkong Board <= 2.1.0.2 - Missing Authorization	CVE-2023-36694	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	July 4, 2023
Sublanguage <= 2.9 - Missing Authorization	CVE-2023-36695	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	July 4, 2023
Mobile Call Now & Map Buttons <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-24401	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	July 4, 2023
LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.68 - Missing Authorization via activate_addon	CVE-2023-36531	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	June 28, 2023
BBS e-Popup <= 2.4.5 - Missing Authorization	CVE-2023-36504	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	June 23, 2023
ReDi Restaurant Reservation <= 23.0211 - Missing Authorization	CVE-2023-36510	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	June 22, 2023
Sermon'e <= 1.0.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-35776	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 19, 2023
Sermon'e <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-35776	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 16, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation