💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Mika

Mika

All Time Ranking

416

All Time Discoveries

90 Day Published Submissions

11 Dec '24

Last Published Submission

2 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 81-100 of 416 Vulnerabilities

Japanized For WooCommerce <= 2.6.4 - Missing Authorization

6.5

CVE-2023-47698

Nov 9, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token

6.5

CVE-2023-46631

Oct 25, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints

6.5

CVE-2023-46608

Oct 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs

6.5

CVE-2023-46195

Oct 18, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing

6.5

CVE-2023-37865

Jul 10, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Uncanny Toolkit for LearnDash <= 3.6.4.3 - Missing Authorization via review-banner-visibility REST route

6.5

CVE-2023-34019

Jun 2, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

ReviewX <= 1.6.7 - Unauthenticated CSV Injection

6.5

CVE-2022-46809

Apr 13, 2023

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal

6.5

CVE-2023-24416

Feb 23, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Icegram Express <= 5.5.2 - Unauthenticated CSV Injection

6.5

CVE-2022-45810

Feb 6, 2023

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection

6.5

CVE-2022-45360

Feb 2, 2023

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Site Reviews <= 6.2.0 - Unauthenticated CSV Injection

6.5

CVE-2022-46801

Jan 27, 2023

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-47229

Nov 3, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

PDF Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-45646

Oct 12, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

QR Twitter Widget <= 0.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVE-2023-45628

Oct 11, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Gumroad <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-45059

Oct 3, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Sitekit <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe ' shortcode

6.4

CVE-2023-27628

Aug 28, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

flowpaper <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-40197

Aug 11, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Library Viewer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-32102

May 3, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Tippy <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode

6.4

CVE-2023-31079

Apr 24, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Kaya QR Code Generator <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute

6.4

CVE-2023-30784

Apr 18, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Japanized For WooCommerce <= 2.6.4 - Missing Authorization	CVE-2023-47698	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	November 9, 2023
Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token	CVE-2023-46631	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	October 25, 2023
DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints	CVE-2023-46608	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	October 24, 2023
Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs	CVE-2023-46195	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	October 18, 2023
Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing	CVE-2023-37865	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	July 10, 2023
Uncanny Toolkit for LearnDash <= 3.6.4.3 - Missing Authorization via review-banner-visibility REST route	CVE-2023-34019	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	June 2, 2023
ReviewX <= 1.6.7 - Unauthenticated CSV Injection	CVE-2022-46809	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L	April 13, 2023
All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal	CVE-2023-24416	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H	February 23, 2023
Icegram Express <= 5.5.2 - Unauthenticated CSV Injection	CVE-2022-45810	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L	February 6, 2023
Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection	CVE-2022-45360	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L	February 2, 2023
Site Reviews <= 6.2.0 - Unauthenticated CSV Injection	CVE-2022-46801	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L	January 27, 2023
Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-47229	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 3, 2023
PDF Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-45646	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	October 12, 2023
QR Twitter Widget <= 0.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode	CVE-2023-45628	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	October 11, 2023
Gumroad <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-45059	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	October 3, 2023
Sitekit <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe ' shortcode	CVE-2023-27628	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 28, 2023
flowpaper <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-40197	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 11, 2023
Library Viewer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-32102	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 3, 2023
Tippy <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode	CVE-2023-31079	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	April 24, 2023
Kaya QR Code Generator <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute	CVE-2023-30784	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	April 18, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation