🦸 Calling all superheroes! Introducing the WordPress Superhero Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities! Through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200. Check out the updated bounties here!

Wordfence Intelligence > Vulnerability Researchers > Bob Matyas

Bob Matyas

All Time Ranking

226

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

Showing 161-180 of 226 Vulnerabilities

Autocomplete Location field Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-5005

Nov 21, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Popup Box <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-5874

Nov 13, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

WP Discord Invite <= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-5181

Oct 16, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Herd Effects <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-4022

Aug 21, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings

4.4

CVE-2023-4254

Aug 8, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-3328

Jul 24, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

WP-EMail <= 2.69.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-3721

Jul 24, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Short URL <= 1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-3130

Jul 10, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Auto Location for WP Job Manager via Google <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting

4.4

CVE-2023-3344

Jul 3, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

AN_GradeBook <= 5.0.1 - Authenticated(Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-2709

Jun 19, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress <= 1.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-3129

Jun 19, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

QuBotChat <= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-2401

May 22, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Misiek Photo Album <= 1.4.3 - Cross-Site Request Forgery to Album Deletion

4.3

CVE-2024-7817

Aug 22, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AZIndex <= 0.8.1 - Cross-Site Request Forgery to Index Deletion

4.3

CVE-2024-7688

Aug 19, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

DN Popup <= 1.2.2 - Cross-Site Request Forgery to Settings Update

4.3

CVE-2024-7690

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

TrueBooker <= 1.0.2 - Cross-Site Request Forgery to Settings Update

4.3

CVE-2024-6925

Aug 10, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

WP eStore <= 8.5.5 - Cross-Site Request Forgery to Settings Reset

4.3

CVE-2024-6136

Jul 19, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

HTML Forms – Simple WordPress Forms Plugin <= 1.3.33 - Cross-Site Request Forgery

4.3

CVE-2024-6412

Jul 10, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

WP Ajax Contact Form <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Email Deletion

4.3

CVE-2024-5808

Jul 9, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Pardakht Delkhah <= 2.9.8 - Cross-Site Request Forgery to Form Setting Reset

4.3

CVE-2024-6230

Jul 9, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Autocomplete Location field Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-5005	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	November 21, 2023
Popup Box <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-5874	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	November 13, 2023
WP Discord Invite <= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-5181	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	October 16, 2023
Herd Effects <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-4022	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 21, 2023
ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings	CVE-2023-4254	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 8, 2023
Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-3328	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	July 24, 2023
WP-EMail <= 2.69.0 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-3721	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	July 24, 2023
Short URL <= 1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting	CVE-2023-3130	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	July 10, 2023
Auto Location for WP Job Manager via Google <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting	CVE-2023-3344	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	July 3, 2023
AN_GradeBook <= 5.0.1 - Authenticated(Administrator+) Stored Cross-Site Scripting	CVE-2023-2709	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	June 19, 2023
URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress <= 1.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-3129	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	June 19, 2023
QuBotChat <= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting	CVE-2023-2401	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	May 22, 2023
Misiek Photo Album <= 1.4.3 - Cross-Site Request Forgery to Album Deletion	CVE-2024-7817	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	August 22, 2024
AZIndex <= 0.8.1 - Cross-Site Request Forgery to Index Deletion	CVE-2024-7688	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	August 19, 2024
DN Popup <= 1.2.2 - Cross-Site Request Forgery to Settings Update	CVE-2024-7690	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	August 12, 2024
TrueBooker <= 1.0.2 - Cross-Site Request Forgery to Settings Update	CVE-2024-6925	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	August 10, 2024
WP eStore <= 8.5.5 - Cross-Site Request Forgery to Settings Reset	CVE-2024-6136	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 19, 2024
HTML Forms – Simple WordPress Forms Plugin <= 1.3.33 - Cross-Site Request Forgery	CVE-2024-6412	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 10, 2024
WP Ajax Contact Form <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Email Deletion	CVE-2024-5808	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 9, 2024
Pardakht Delkhah <= 2.9.8 - Cross-Site Request Forgery to Form Setting Reset	CVE-2024-6230	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 9, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation