Wordfence Intelligence   >   Vulnerability Researchers   >   Bob Matyas

Bob Matyas

Organization: Automattic

13
All Time Ranking
255
All Time Discoveries
0
90 Day Published Submissions
N/A
Last Published Submission

Showing 1-20 of 255 Vulnerabilities

Tabs Shortcode <= 2.0.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
6.4
CVE-2024-11606
Dec 17, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Tour Master - Tour Booking, Travel, Hotel < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking
7.2
CVE-2024-11356
Dec 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Tithe.ly Giving Button <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11841
Dec 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WP-SVG <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-11644
Dec 6, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Float Block <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-11645
Dec 6, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
DN Shipping by Weight for WooCommerce <= 1.1.1 - Cross-Site Request Forgery to Plugin Settings Update
4.3
CVE-2024-11842
Dec 6, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Connexion Logs <= 3.0.2 - Cross-Site Request Forgery to Log Deletion
5.3
CVE-2024-11373
Dec 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Full Screen (Page) Background Image Slideshow <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-11221
Nov 13, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-11140
Nov 12, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
YaDisk Files <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
7.4
CVE-2024-10709
Nov 4, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
YaDisk Files <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-10710
Nov 4, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Planning Center Online Giving <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-11502
Nov 3, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Alphabetical List <= 1.0.3 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2024-8157
Oct 31, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Media Library Tools <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-10482
Oct 31, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
BTEV <= Cross-Site Request Forgery to Plugin Settings Update
4.3
CVE-2024-10677
Oct 31, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-9836
Oct 22, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
RSS Feed Widget <= 3.0.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']
6.1
CVE-2024-9835
Oct 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Registrations for the Events Calendar – Event Registration Plugin <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-7982
Oct 18, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Post From Frontend <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Post Deletion
5.3
CVE-2024-9689
Oct 15, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Event Calendar <= 1.0.4 - Missing Authorization to Unauthenticated Arbitrary Calendar Deletion
5.3
CVE-2024-8700
Oct 10, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Tabs Shortcode <= 2.0.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode CVE-2024-11606 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 17, 2024
Tour Master - Tour Booking, Travel, Hotel < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking CVE-2024-11356 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N December 16, 2024
Tithe.ly Giving Button <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11841 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 9, 2024
WP-SVG <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-11644 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N December 6, 2024
Float Block <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-11645 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N December 6, 2024
DN Shipping by Weight for WooCommerce <= 1.1.1 - Cross-Site Request Forgery to Plugin Settings Update CVE-2024-11842 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N December 6, 2024
Connexion Logs <= 3.0.2 - Cross-Site Request Forgery to Log Deletion CVE-2024-11373 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N December 2, 2024
Full Screen (Page) Background Image Slideshow <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-11221 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N November 13, 2024
Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-11140 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N November 12, 2024
YaDisk Files <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-10709 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L November 4, 2024
YaDisk Files <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-10710 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N November 4, 2024
Planning Center Online Giving <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-11502 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 3, 2024
Alphabetical List <= 1.0.3 - Cross-Site Request Forgery to Settings Update CVE-2024-8157 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 31, 2024
Media Library Tools <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-10482 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 31, 2024
BTEV <= Cross-Site Request Forgery to Plugin Settings Update CVE-2024-10677 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N October 31, 2024
RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-9836 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N October 22, 2024
RSS Feed Widget <= 3.0.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] CVE-2024-9835 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 22, 2024
Registrations for the Events Calendar – Event Registration Plugin <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting CVE-2024-7982 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N October 18, 2024
Post From Frontend <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Post Deletion CVE-2024-9689 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N October 15, 2024
Event Calendar <= 1.0.4 - Missing Authorization to Unauthenticated Arbitrary Calendar Deletion CVE-2024-8700 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N October 10, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation