💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Mika

Mika

All Time Ranking

416

All Time Discoveries

90 Day Published Submissions

11 Dec '24

Last Published Submission

2 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 181-200 of 416 Vulnerabilities

Japanized For WooCommerce <= 2.6.4 - Missing Authorization

6.5

CVE-2023-47698

Nov 9, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Plainview Protect Passwords <= 1.4 - Reflected Cross-Site Scripting

6.1

CVE-2023-47665

Nov 8, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Plainview Protect Passwords <= 1.4 - Cross-Site Request Forgery

4.3

CVE-2023-47664

Nov 8, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization

5.3

CVE-2023-47241

Nov 7, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Email Marketing for WooCommerce by Omnisend <= 1.13.8 - Sensitive Information Exposure

5.3

CVE-2023-47244

Nov 7, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

ANAC XML Viewer <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-47245

Nov 7, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

WP Travel <= 7.7.0 - Missing Authorization via Multiple AJAX Actions

7.5

CVE-2023-47224

Nov 3, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-47229

Nov 3, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Feather Login Page <= 1.1.3 - Cross-Site Request Forgery

4.3

CVE-2023-46777

Oct 26, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token

6.5

CVE-2023-46631

Oct 25, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

WCP OpenWeather <= 2.5.0 - Cross-Site Request Forgery

4.3

CVE-2023-46638

Oct 25, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Convertful – Your Ultimate On-Site Conversion Tool <= 2.5 - Missing Authorization via add_woo_coupon

5.3

CVE-2023-46605

Oct 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints

6.5

CVE-2023-46608

Oct 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

FeedFocal <= 1.2.2 - Missing Authorization via feedfocal_api_setup REST function

5.3

CVE-2023-46609

Oct 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

KD Coming Soon <= 1.7 - Unauthenticated PHP Object Injection via cetitle

8.1

CVE-2023-46615

Oct 24, 2023

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AtomChat <= 1.1.4 - Missing Authorization via credits REST API Endpoint

5.3

CVE-2023-46606

Oct 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Motors – Car Dealer & Classified Ads <= 1.4.6 - Reflected Cross-Site Scripting

6.1

CVE-2023-46208

Oct 19, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery

7.2

CVE-2023-46207

Oct 19, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs

6.5

CVE-2023-46195

Oct 18, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Appointment Calendar <= 2.9.6 - Cross-Site Request Forgery

5.4

CVE-2023-46198

Oct 18, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Title	CVE ID	CVSS	Vector	Date
Japanized For WooCommerce <= 2.6.4 - Missing Authorization	CVE-2023-47698	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	November 9, 2023
Plainview Protect Passwords <= 1.4 - Reflected Cross-Site Scripting	CVE-2023-47665	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 8, 2023
Plainview Protect Passwords <= 1.4 - Cross-Site Request Forgery	CVE-2023-47664	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 8, 2023
CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization	CVE-2023-47241	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	November 7, 2023
Email Marketing for WooCommerce by Omnisend <= 1.13.8 - Sensitive Information Exposure	CVE-2023-47244	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	November 7, 2023
ANAC XML Viewer <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-47245	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	November 7, 2023
WP Travel <= 7.7.0 - Missing Authorization via Multiple AJAX Actions	CVE-2023-47224	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	November 3, 2023
Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-47229	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 3, 2023
Feather Login Page <= 1.1.3 - Cross-Site Request Forgery	CVE-2023-46777	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	October 26, 2023
Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token	CVE-2023-46631	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	October 25, 2023
WCP OpenWeather <= 2.5.0 - Cross-Site Request Forgery	CVE-2023-46638	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	October 25, 2023
Convertful – Your Ultimate On-Site Conversion Tool <= 2.5 - Missing Authorization via add_woo_coupon	CVE-2023-46605	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 24, 2023
DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints	CVE-2023-46608	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	October 24, 2023
FeedFocal <= 1.2.2 - Missing Authorization via feedfocal_api_setup REST function	CVE-2023-46609	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 24, 2023
KD Coming Soon <= 1.7 - Unauthenticated PHP Object Injection via cetitle	CVE-2023-46615	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	October 24, 2023
AtomChat <= 1.1.4 - Missing Authorization via credits REST API Endpoint	CVE-2023-46606	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 24, 2023
Motors – Car Dealer & Classified Ads <= 1.4.6 - Reflected Cross-Site Scripting	CVE-2023-46208	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	October 19, 2023
Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery	CVE-2023-46207	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	October 19, 2023
Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs	CVE-2023-46195	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	October 18, 2023
Appointment Calendar <= 2.9.6 - Cross-Site Request Forgery	CVE-2023-46198	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L	October 18, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation