Wordfence Intelligence   >   Vulnerability Researchers   >   Joshua Chan

Joshua Chan

28
All Time Ranking
167
All Time Discoveries
1
90 Day Published Submissions
6 Jan '25
Last Published Submission

About

Penetration Tester, Security Researcher

2 Achievements

Learn more about Achievements
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 6, 2025
Submitted 1 Vulnerability
Submitted 1 Vulnerability
October 9, 2024
Learn more Learn more about Achievements

Showing 1-20 of 167 Vulnerabilities

AIO Performance Profiler, Monitor, Optimize, Compress & Debug <= 1.2 - Missing Authorization
4.3
CVE-2025-22647
Feb 3, 2025
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WP Go Maps <= 9.0.40 - Cross-Site Request Forgery
4.3
CVE-2025-24742
Jan 24, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP PT-Viewer <= 2.0.2 - Reflected Cross-Site Scripting
6.1
CVE-2025-23438
Jan 16, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Wp-Scribd-List <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-23436
Jan 16, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure
5.3
CVE-2024-12159
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-22295
Jan 6, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure
5.3
CVE-2024-12250
Dec 17, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files
7.2
CVE-2024-9698
Dec 13, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
WP-NERD Toolkit <= 1.1 - Unauthenticated Information Exposure
5.3
CVE-2024-54279
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure
5.3
CVE-2024-12255
Dec 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Import Export For WooCommerce <= 1.5 - Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-54262
Dec 6, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Content Audit Exporter <= 1.1 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-53768
Nov 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Advanced What should we write next about <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
4.3
CVE-2024-53789
Nov 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Multi Feed Reader <= 2.2.4 - Cross-Site Request Forgery
4.3
CVE-2024-53718
Nov 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
MooWoodle – WordPress & Moodle LMS Integration Bridge <= 3.2.4 - Unauthenticated Sensitive Information Exposure
7.5
CVE-2025-24556
Nov 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Hacklog DownloadManager <= 2.1.4 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2024-52401
Nov 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CDI <= 5.5.3 - Authenticated (Shop Manager+) Arbitrary File Upload
7.2
CVE-2024-52398
Nov 13, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2024-52402
Nov 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SV Forms <= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-51877
Nov 8, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-51819
Nov 8, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
AIO Performance Profiler, Monitor, Optimize, Compress & Debug <= 1.2 - Missing Authorization CVE-2025-22647 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 3, 2025
WP Go Maps <= 9.0.40 - Cross-Site Request Forgery CVE-2025-24742 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 24, 2025
WP PT-Viewer <= 2.0.2 - Reflected Cross-Site Scripting CVE-2025-23438 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 16, 2025
Wp-Scribd-List <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-23436 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 16, 2025
Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure CVE-2024-12159 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N January 6, 2025
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.6 - Unauthenticated Stored Cross-Site Scripting CVE-2025-22295 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N January 6, 2025
Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure CVE-2024-12250 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 17, 2024
Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files CVE-2024-9698 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H December 13, 2024
WP-NERD Toolkit <= 1.1 - Unauthenticated Information Exposure CVE-2024-54279 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 11, 2024
Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure CVE-2024-12255 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 11, 2024
Import Export For WooCommerce <= 1.5 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-54262 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H December 6, 2024
Content Audit Exporter <= 1.1 - Unauthenticated Sensitive Information Exposure CVE-2024-53768 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 28, 2024
Advanced What should we write next about <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-53789 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N November 28, 2024
Multi Feed Reader <= 2.2.4 - Cross-Site Request Forgery CVE-2024-53718 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N November 22, 2024
MooWoodle – WordPress & Moodle LMS Integration Bridge <= 3.2.4 - Unauthenticated Sensitive Information Exposure CVE-2025-24556 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N November 16, 2024
Hacklog DownloadManager <= 2.1.4 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2024-52401 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 13, 2024
CDI <= 5.5.3 - Authenticated (Shop Manager+) Arbitrary File Upload CVE-2024-52398 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H November 13, 2024
Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2024-52402 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H November 13, 2024
SV Forms <= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-51877 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 8, 2024
Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-51819 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N November 8, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation

This site uses cookies in accordance with our Privacy Policy.