🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Alex Sanford

Alex Sanford

121

All Time Ranking

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

Showing 1-20 of 25 Vulnerabilities

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection

7.2

CVE-2023-6620

Dec 21, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Quiz Maker <= 6.4.9.4 - Reflected Cross-Site Scripting

6.1

CVE-2023-6166

Nov 30, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

rtMedia for WordPress, BuddyPress and bbPress WordPress <= 4.6.15 - Authenticated (Admin+) Arbitrary File Upload

7.2

CVE-2023-5939

Nov 29, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Cross-Site Request Forgery to PHAR Deserialization

8.8

CVE-2023-5886

Nov 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

WP Fastest Cache <= 1.2.2 - Unauthenticated SQL Injection

9.8

CVE-2023-6063

Nov 13, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EventPrime <= 3.3.2 - Improper Server-Side Checks to Booking Payment Bypass

5.3

CVE-2023-4252

Oct 30, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Awesome Support <= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion

8.1

CVE-2023-5355

Oct 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Awesome Support <= 6.1.4 - Reflected Cross-Site Scripting

6.1

CVE-2023-5354

Oct 16, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EventPrime < 3.2.0 - Cross-Site Request Forgery

4.3

CVE-2023-4251

Oct 9, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion

4.9

CVE-2023-3279

Sep 25, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

File Manager Pro – Filester <= 1.8 - Authenticated (Admin+) Arbitrary File Upload

7.2

CVE-2023-4861

Sep 19, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

File Manager Pro <= 1.8 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-4862

Sep 19, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

All in One B2B for WooCommerce <= 1.0.3 - Cross-Site Request Forgery

6.5

CVE-2023-3547

Sep 4, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-2802

Jul 24, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'

6.1

CVE-2023-2309

Jul 3, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WP ERP <= 1.12.3 - Reflected Cross-Site Scripting

6.1

CVE-2023-2743

Jun 5, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation

6.5

CVE-2023-2877

May 31, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Otter - Gutenberg Blocks <= 2.2.5 - Authenticated (Author+) PHAR Deserialization

8.8

CVE-2023-2288

May 2, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PPOM for WooCommerce <= 32.0.6 - Reflected Cross-Site Scripting

6.1

CVE-2023-2256

May 1, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Orbit Fox by ThemeIsle <= 2.10.23 - Authenticated (Author+) Server-Side Request Forgery via URL

7.4

CVE-2023-2287

Apr 27, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Title	CVE ID	CVSS	Vector	Date
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection	CVE-2023-6620	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	December 21, 2023
Quiz Maker <= 6.4.9.4 - Reflected Cross-Site Scripting	CVE-2023-6166	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 30, 2023
rtMedia for WordPress, BuddyPress and bbPress WordPress <= 4.6.15 - Authenticated (Admin+) Arbitrary File Upload	CVE-2023-5939	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 29, 2023
Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Cross-Site Request Forgery to PHAR Deserialization	CVE-2023-5886	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	November 24, 2023
WP Fastest Cache <= 1.2.2 - Unauthenticated SQL Injection	CVE-2023-6063	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 13, 2023
EventPrime <= 3.3.2 - Improper Server-Side Checks to Booking Payment Bypass	CVE-2023-4252	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 30, 2023
Awesome Support <= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion	CVE-2023-5355	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	October 16, 2023
Awesome Support <= 6.1.4 - Reflected Cross-Site Scripting	CVE-2023-5354	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	October 16, 2023
EventPrime < 3.2.0 - Cross-Site Request Forgery	CVE-2023-4251	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	October 9, 2023
WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion	CVE-2023-3279	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	September 25, 2023
File Manager Pro – Filester <= 1.8 - Authenticated (Admin+) Arbitrary File Upload	CVE-2023-4861	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	September 19, 2023
File Manager Pro <= 1.8 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-4862	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	September 19, 2023
All in One B2B for WooCommerce <= 1.0.3 - Cross-Site Request Forgery	CVE-2023-3547	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	September 4, 2023
Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-2802	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	July 24, 2023
wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'	CVE-2023-2309	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	July 3, 2023
WP ERP <= 1.12.3 - Reflected Cross-Site Scripting	CVE-2023-2743	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	June 5, 2023
Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation	CVE-2023-2877	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	May 31, 2023
Otter - Gutenberg Blocks <= 2.2.5 - Authenticated (Author+) PHAR Deserialization	CVE-2023-2288	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 2, 2023
PPOM for WooCommerce <= 32.0.6 - Reflected Cross-Site Scripting	CVE-2023-2256	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	May 1, 2023
Orbit Fox by ThemeIsle <= 2.10.23 - Authenticated (Author+) Server-Side Request Forgery via URL	CVE-2023-2287	7.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L	April 27, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation