🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Jerome Bruandet

Jerome Bruandet

Organization: NinTechNet

All Time Ranking

212

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

Showing 81-100 of 212 Vulnerabilities

Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

7.2

CVE-2020-36731

Feb 26, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

DELUCKS SEO < 2.1.8 - Stored Cross Site Scripting

7.2

CVE-2019-25146

Sep 21, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authorization

7.2

CVE-2019-15776

Aug 10, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection

7.2

CVE-2019-25145

Jul 27, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting

7.2

CVE-2019-25140

Jul 16, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link

7.2

CVE-2019-25147

Jun 19, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Kali Forms <= 2.1.1 - Missing Authorization to Settings Update

7.1

CVE-2020-36720

Aug 21, 2020

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification

6.5

CVE-2023-3125

Jun 3, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

WooCommerce Multi Currency <= 2.1.17 - Missing Authorization

6.5

CVE-2021-4379

Sep 13, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting

6.5

CVE-2021-4372

Aug 31, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion

6.5

CVE-2021-4359

Jul 12, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion

6.5

CVE-2021-4345

Jan 28, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Doneren met Mollie <= 2.8.4 - Information Disclosure

6.5

CVE-2021-4377

Jan 22, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation

6.5

CVE-2020-36721

Oct 1, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal

6.5

CVE-2020-36728

Jul 7, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Elementor Website Builder <= 2.9.5 - Authorization Bypass

6.5

CVE-2020-20634

Mar 31, 2020

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated Settings Import/Export

6.5

CVE-2019-17228

Sep 20, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset

6.5

CVE-2019-25139

Jul 17, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Frontend File Manager <= 18.2 - Privilege Escalation

6.4

CVE-2021-4344

Jul 12, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

404 to 301 <= 3.0.7 - Missing Authorization to Redirect Creation

6.4

CVE-2021-4338

Jun 18, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update	CVE-2020-36731	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	February 26, 2020
DELUCKS SEO < 2.1.8 - Stored Cross Site Scripting	CVE-2019-25146	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	September 21, 2019
Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authorization	CVE-2019-15776	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 10, 2019
Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection	CVE-2019-25145	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 27, 2019
Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting	CVE-2019-25140	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 16, 2019
Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link	CVE-2019-25147	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	June 19, 2019
Kali Forms <= 2.1.1 - Missing Authorization to Settings Update	CVE-2020-36720	7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	August 21, 2020
B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification	CVE-2023-3125	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	June 3, 2023
WooCommerce Multi Currency <= 2.1.17 - Missing Authorization	CVE-2021-4379	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	September 13, 2021
WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting	CVE-2021-4372	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	August 31, 2021
Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion	CVE-2021-4359	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	July 12, 2021
uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion	CVE-2021-4345	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	January 28, 2021
Doneren met Mollie <= 2.8.4 - Information Disclosure	CVE-2021-4377	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	January 22, 2021
Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation	CVE-2020-36721	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	October 1, 2020
Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal	CVE-2020-36728	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	July 7, 2020
Elementor Website Builder <= 2.9.5 - Authorization Bypass	CVE-2020-20634	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	March 31, 2020
Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated Settings Import/Export	CVE-2019-17228	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	September 20, 2019
Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset	CVE-2019-25139	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	July 17, 2019
Frontend File Manager <= 18.2 - Privilege Escalation	CVE-2021-4344	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 12, 2021
404 to 301 <= 3.0.7 - Missing Authorization to Redirect Creation	CVE-2021-4338	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 18, 2021

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation