Wordfence Intelligence   >   Vulnerability Researchers   >   Lucio Sá

Lucio Sá

14
All Time Ranking
230
All Time Discoveries
68
90 Day Published Submissions
12 Sep '24
Last Published Submission

10 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 200 Vulnerabilities
Submitted 200 Vulnerabilities
August 22, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 24, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
March 19, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 6, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 12, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
January 17, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 16, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
December 19, 2023
Learn more Learn more about Achievements

Showing 201-220 of 230 Vulnerabilities

WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure
4.3
CVE-2024-2384
Mar 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion
4.3
CVE-2024-2222
Mar 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
RevivePress – Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization
4.3
CVE-2024-1844
Mar 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
4.3
CVE-2024-1503
Mar 12, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink
4.3
CVE-2024-1843
Mar 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Mollie Forms <= 2.6.3 - Missing Authorization
4.3
CVE-2024-1645
Mar 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication
4.3
CVE-2024-1400
Mar 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
4.3
CVE-2024-1124
Mar 8, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product
4.3
CVE-2024-2298
Mar 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Export
4.3
CVE-2024-1690
Mar 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization
4.3
CVE-2024-1158
Mar 6, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset
4.3
CVE-2024-1388
Feb 27, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset
4.3
CVE-2024-1943
Feb 27, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation
4.3
CVE-2024-1861
Feb 27, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
4.3
CVE-2024-1362
Feb 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder
4.3
CVE-2024-1361
Feb 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation
4.3
CVE-2024-1360
Feb 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
4.3
CVE-2024-1218
Feb 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export
4.3
CVE-2024-1127
Feb 14, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page
4.3
CVE-2024-1390
Feb 13, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure CVE-2024-2384 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N March 19, 2024
Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion CVE-2024-2222 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 19, 2024
RevivePress – Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization CVE-2024-1844 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 19, 2024
Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase CVE-2024-1503 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N March 12, 2024
Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink CVE-2024-1843 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 11, 2024
Mollie Forms <= 2.6.3 - Missing Authorization CVE-2024-1645 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N March 11, 2024
Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication CVE-2024-1400 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 11, 2024
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending CVE-2024-1124 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 8, 2024
affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product CVE-2024-2298 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 7, 2024
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Export CVE-2024-1690 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N March 7, 2024
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization CVE-2024-1158 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N March 6, 2024
Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset CVE-2024-1388 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 27, 2024
Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset CVE-2024-1943 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 27, 2024
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation CVE-2024-1861 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 27, 2024
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh CVE-2024-1362 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 22, 2024
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder CVE-2024-1361 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 22, 2024
Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation CVE-2024-1360 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N February 22, 2024
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization CVE-2024-1218 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N February 19, 2024
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export CVE-2024-1127 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N February 14, 2024
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page CVE-2024-1390 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N February 13, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation