🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > vgo0

vgo0

All Time Ranking

140

All Time Discoveries

131

90 Day Published Submissions

4 Dec '24

Last Published Submission

8 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 1-20 of 140 Vulnerabilities

Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function

9.9

CVE-2024-11082

Nov 27, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload

9.8

CVE-2024-10392

Oct 30, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update

8.8

CVE-2024-11194

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update

8.8

CVE-2024-10711

Nov 4, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update

8.8

CVE-2024-7423

Sep 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update

8.8

CVE-2024-7492

Aug 7, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update

8.1

CVE-2024-11601

Nov 21, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

8.1

CVE-2024-11104

Nov 21, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting

7.1

CVE-2024-8981

Sep 30, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Memberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-9242

Oct 3, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Advanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-7599

Sep 5, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Dynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter

6.4

CVE-2024-6929

Sep 4, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode

6.4

CVE-2024-6363

Jun 28, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scripting

6.1

CVE-2024-11324

Dec 4, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Additional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting

6.1

CVE-2024-11814

Dec 3, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NPS computy <= 2.8.0 - Reflected Cross-Site Scripting

6.1

CVE-2024-11807

Dec 3, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Posti Shipping <= 3.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via generate_notices_html Function

6.1

CVE-2024-10832

Dec 3, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting

6.1

CVE-2024-11466

Dec 3, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting

6.1

CVE-2024-11326

Dec 2, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting

6.1

CVE-2024-11805

Dec 2, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function	CVE-2024-11082	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	November 27, 2024
AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload	CVE-2024-10392	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	October 30, 2024
Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update	CVE-2024-11194	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	November 18, 2024
WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update	CVE-2024-10711	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	November 4, 2024
Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update	CVE-2024-7423	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	September 12, 2024
MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update	CVE-2024-7492	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	August 7, 2024
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update	CVE-2024-11601	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H	November 21, 2024
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update	CVE-2024-11104	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	November 21, 2024
Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting	CVE-2024-8981	7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	September 30, 2024
Memberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting	CVE-2024-9242	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	October 3, 2024
Advanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-7599	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	September 5, 2024
Dynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter	CVE-2024-6929	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	September 4, 2024
Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode	CVE-2024-6363	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 28, 2024
Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scripting	CVE-2024-11324	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 4, 2024
Additional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting	CVE-2024-11814	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 3, 2024
NPS computy <= 2.8.0 - Reflected Cross-Site Scripting	CVE-2024-11807	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 3, 2024
Posti Shipping <= 3.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via generate_notices_html Function	CVE-2024-10832	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 3, 2024
Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting	CVE-2024-11466	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 3, 2024
Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting	CVE-2024-11326	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 2, 2024
Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting	CVE-2024-11805	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 2, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation