🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Henri Salo (fgeek)

Henri Salo (fgeek)

156

All Time Ranking

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

18 Vulnerabilities

Easy Forms for Mailchimp <= 6.5.2 - Code Injection

9.8

CVE-2019-15318

Jul 1, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WP Human Resource Management < 2.2.6 - Sensitive Information Disclosure

7.5

CVE-2019-9574

Mar 17, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

WP Human Resource Management Plugin < 2.2.6 - Authorization Bypass

7.5

CVE-2019-9573

Feb 23, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting

6.1

CVE-2019-9912

Feb 5, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Nelio AB Testing < 4.5.0 - Directory Traversal

6.5

CVE-2016-10977

May 10, 2016

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Gravityforms <= 1.9.15.11 - Cross-Site Scripting

4.7

CVE ID Unknown

Mar 1, 2016

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Export WordPress Data with Advanced Filters < 1.2 - SQL Injection

9.8

CVE-2016-11000

Feb 25, 2016

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WP Smiley <= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting

6.1

CVE-2015-4140

May 29, 2015

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

DB Backup < 5.0 - Directory Traversal

7.5

CVE-2014-9119

Dec 16, 2014

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CM Download Manager <= 2.0.6 - Cross-Site Request Forgery to Cross-Site Scripting

6.1

CVE-2014-9129

Dec 1, 2014

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WP Source Control < 3.1.1 - Directory Traversal

7.5

CVE-2014-5368

Aug 19, 2014

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EZPZ One Click Backup <= 12.03.10 - Unauthenticated Command Injection

9.8

CVE-2014-3114

Aug 1, 2014

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Adminimize <= 1.7.21 - Cross-Site Scripting

6.1

CVE-2011-4926

Aug 1, 2014

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Flash player widget <= 1.3 - Content Spoofing

4.7

CVE ID Unknown

Dec 30, 2013

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Advanced Dewplayer < 1.3 - Directory Traversal

7.5

CVE-2013-7240

Dec 30, 2013

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

WP Cleanfix Plugin < 5.0.0 - Remote Code Execution

8.8

CVE-2013-2109

May 18, 2013

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Mail On Update < 5.3.0 - Cross-Site Request Forgery

8.8

CVE-2013-2107

May 16, 2013

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Smart Flv <= 1.0 - Cross-Site Scripting

6.1

CVE-2013-1765

Feb 19, 2013

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Easy Forms for Mailchimp <= 6.5.2 - Code Injection	CVE-2019-15318	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 1, 2019
WP Human Resource Management < 2.2.6 - Sensitive Information Disclosure	CVE-2019-9574	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	March 17, 2019
WP Human Resource Management Plugin < 2.2.6 - Authorization Bypass	CVE-2019-9573	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	February 23, 2019
WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting	CVE-2019-9912	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 5, 2019
Nelio AB Testing < 4.5.0 - Directory Traversal	CVE-2016-10977	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	May 10, 2016
Gravityforms <= 1.9.15.11 - Cross-Site Scripting		4.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	March 1, 2016
Export WordPress Data with Advanced Filters < 1.2 - SQL Injection	CVE-2016-11000	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	February 25, 2016
WP Smiley <= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting	CVE-2015-4140	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	May 29, 2015
DB Backup < 5.0 - Directory Traversal	CVE-2014-9119	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	December 16, 2014
CM Download Manager <= 2.0.6 - Cross-Site Request Forgery to Cross-Site Scripting	CVE-2014-9129	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 1, 2014
WP Source Control < 3.1.1 - Directory Traversal	CVE-2014-5368	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	August 19, 2014
EZPZ One Click Backup <= 12.03.10 - Unauthenticated Command Injection	CVE-2014-3114	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	August 1, 2014
Adminimize <= 1.7.21 - Cross-Site Scripting	CVE-2011-4926	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 1, 2014
Flash player widget <= 1.3 - Content Spoofing		4.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	December 30, 2013
Advanced Dewplayer < 1.3 - Directory Traversal	CVE-2013-7240	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	December 30, 2013
WP Cleanfix Plugin < 5.0.0 - Remote Code Execution	CVE-2013-2109	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	May 18, 2013
Mail On Update < 5.3.0 - Cross-Site Request Forgery	CVE-2013-2107	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	May 16, 2013
Smart Flv <= 1.0 - Cross-Site Scripting	CVE-2013-1765	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 19, 2013

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation