Wordfence Intelligence   >   Vulnerability Researchers   >   Asaf Mozes

Asaf Mozes

266
All Time Ranking
10
All Time Discoveries
6
90 Day Published Submissions
26 Feb '25
Last Published Submission

4 Achievements

Learn more about Achievements
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
February 26, 2025
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 13, 2025
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
March 4, 2024
Learn more Learn more about Achievements

10 Vulnerabilities

Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-0469
Feb 26, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
5.3
CVE-2024-13821
Feb 11, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
6.4
CVE-2024-13403
Feb 3, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter
6.1
CVE-2025-0470
Jan 30, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
6.1
CVE-2025-0215
Jan 15, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode
6.4
CVE-2024-13323
Jan 13, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion
4.3
CVE-2024-10593
Nov 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
5.3
CVE-2024-3649
May 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
6.1
CVE-2024-2242
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-2020
Mar 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-0469 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N February 26, 2025
WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation CVE-2024-13821 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N February 11, 2025
WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter CVE-2024-13403 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N February 3, 2025
Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter CVE-2025-0470 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 30, 2025
UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting CVE-2025-0215 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 15, 2025
Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode CVE-2024-13323 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N January 13, 2025
WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion CVE-2024-10593 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N November 12, 2024
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation CVE-2024-3649 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N May 1, 2024
Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting CVE-2024-2242 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 13, 2024
Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting CVE-2024-2020 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N March 1, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation

This site uses cookies in accordance with our Privacy Policy.