Wordfence Intelligence   >   Vulnerability Researchers   >   Joshua Chan

Joshua Chan

27
All Time Ranking
132
All Time Discoveries
0
90 Day Published Submissions
N/A
Last Published Submission

About

Penetration Tester, Security Researcher

Showing 1-20 of 132 Vulnerabilities

Contest Gallery <= 23.1.2 - Unauthenticated Information Exposure
5.3
CVE-2024-43283
Aug 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Order Export for WooCommerce <= 3.23 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-43259
Aug 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Clearfy Cache <= 2.2.3 - Missing Authorization
4.3
CVE-2024-43260
Aug 12, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Social Slider Feed <= 2.2.1 - Missing Authorization
4.3
CVE-2024-43215
Aug 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Robin image optimizer <= 1.6.9 - Missing Authorization
4.3
CVE-2024-43122
Aug 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.18 - Cross-Site Request Forgery
4.3
CVE-2024-39657
Aug 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Sign-up Sheets <= 2.2.12 - Missing Authorization
5.3
CVE-2024-39654
Aug 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.77 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-39655
Aug 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Custom Query Blocks <= 5.2.0 - Missing Authorization via REST Routes
5.3
CVE-2024-38794
Jul 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery
4.3
CVE-2024-38762
Jul 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Send Users Email <= 1.5.1 - Unauthenticated Information Exposure
5.3
CVE-2024-38760
Jul 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure
5.3
CVE-2024-38761
Jul 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Amazing Hover Effects <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-38741
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Titan Anti-spam & Security <= 7.3.7 - Missing Authorization
4.3
CVE-2024-38777
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Auto Featured Image (Auto Post Thumbnail) <= 4.0.0 - Missing Authorization
4.3
CVE-2024-38719
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
HitPay Payment Gateway for WooCommerce <= 4.1.3 - Information Exposure via Log Files
5.3
CVE-2024-38747
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
MBE eShip <= 2.1.2 - Information Exposure
5.3
CVE-2024-38742
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Wallet System for WooCommerce <= 2.5.13 - Information Exposure via Log Files
5.3
CVE-2024-38699
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Coming Soon <= 1.6.3 - Unauthenticated Information Exposure
5.3
CVE-2024-38756
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
MBE eShip <= 2.1.2 - Cross-Site Request Forgery
4.3
CVE-2024-38729
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Contest Gallery <= 23.1.2 - Unauthenticated Information Exposure CVE-2024-43283 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N August 16, 2024
Order Export for WooCommerce <= 3.23 - Unauthenticated Sensitive Information Exposure CVE-2024-43259 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N August 12, 2024
Clearfy Cache <= 2.2.3 - Missing Authorization CVE-2024-43260 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N August 12, 2024
Social Slider Feed <= 2.2.1 - Missing Authorization CVE-2024-43215 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N August 9, 2024
Robin image optimizer <= 1.6.9 - Missing Authorization CVE-2024-43122 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N August 7, 2024
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.18 - Cross-Site Request Forgery CVE-2024-39657 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 1, 2024
Sign-up Sheets <= 2.2.12 - Missing Authorization CVE-2024-39654 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N August 1, 2024
LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.77 - Unauthenticated Stored Cross-Site Scripting CVE-2024-39655 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N August 1, 2024
Custom Query Blocks <= 5.2.0 - Missing Authorization via REST Routes CVE-2024-38794 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 22, 2024
Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery CVE-2024-38762 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 12, 2024
Send Users Email <= 1.5.1 - Unauthenticated Information Exposure CVE-2024-38760 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 12, 2024
Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure CVE-2024-38761 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 12, 2024
Amazing Hover Effects <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-38741 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Titan Anti-spam & Security <= 7.3.7 - Missing Authorization CVE-2024-38777 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 11, 2024
Auto Featured Image (Auto Post Thumbnail) <= 4.0.0 - Missing Authorization CVE-2024-38719 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 11, 2024
HitPay Payment Gateway for WooCommerce <= 4.1.3 - Information Exposure via Log Files CVE-2024-38747 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 11, 2024
MBE eShip <= 2.1.2 - Information Exposure CVE-2024-38742 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 11, 2024
Wallet System for WooCommerce <= 2.5.13 - Information Exposure via Log Files CVE-2024-38699 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 11, 2024
Coming Soon <= 1.6.3 - Unauthenticated Information Exposure CVE-2024-38756 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 11, 2024
MBE eShip <= 2.1.2 - Cross-Site Request Forgery CVE-2024-38729 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 11, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation