💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Mika

Mika

All Time Ranking

416

All Time Discoveries

90 Day Published Submissions

11 Dec '24

Last Published Submission

2 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 101-120 of 416 Vulnerabilities

Cryptocurrency All-in-One <= 3.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-29435

Apr 6, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

IFrame Shortcode <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-29436

Apr 6, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Site Reviews <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute

6.4

CVE-2023-27629

Mar 13, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Simple Vimeo Shortcode <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVE-2023-27443

Mar 2, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Sp*tify Play Button for WordPress <= 2.05 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-26536

Feb 24, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Remote Content Shortcode <= 1.5 - Authenticated(Contributor+) Local File Inclusion via shortcode

6.3

CVE-2023-45652

Oct 12, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

ProfileGrid <= 5.1.7 - Authenticated (Subscriber+) CSV Injection

6.3

CVE-2022-41791

Nov 17, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CarDealerPress <= 6.6.2410.02 - Reflected Cross-Site Scripting

6.1

CVE-2024-54325

Dec 11, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Media Downloader <= 0.4.7.4 - Reflected Cross-Site Scripting

6.1

CVE-2024-54322

Dec 11, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SMSify <= 6.0.4 - Reflected Cross-Site Scripting

6.1

CVE-2024-54324

Dec 11, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

LDD Directory Lite <= 3.3 - Reflected Cross-Site Scripting

6.1

CVE-2024-54288

Dec 11, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dynamic URL SEO <= 1.0 - Unauthenticated Cross-Site Scripting

6.1

CVE-2024-52470

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Open edX LMS <= 2.6.1 - Reflected Cross-Site Scripting

6.1

CVE-2024-52452

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Explara Events <= 0.1.3 - Reflected Cross-Site Scripting

6.1

CVE-2024-52466

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

GoQMieruca <= 1.0.0 - Reflected Cross-Site Scripting

6.1

CVE-2024-52454

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

GoQSmile <= 1.0.1 - Reflected Cross-Site Scripting

6.1

CVE-2024-52455

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting

6.1

CVE-2024-52453

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Post By Email <= 1.0.4b - Reflected Cross-Site Scripting

6.1

CVE-2024-52463

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WooCommerce Price Alert <= 1.0.4 - Reflected Cross-Site Scripting

6.1

CVE-2024-52469

Nov 18, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dashing Memberships <= 1.1 - Reflected Cross-Site Scripting

6.1

CVE-2024-51760

Nov 4, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Cryptocurrency All-in-One <= 3.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-29435	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	April 6, 2023
IFrame Shortcode <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-29436	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	April 6, 2023
Site Reviews <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute	CVE-2023-27629	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	March 13, 2023
Simple Vimeo Shortcode <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode	CVE-2023-27443	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	March 2, 2023
Sp*tify Play Button for WordPress <= 2.05 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-26536	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	February 24, 2023
Remote Content Shortcode <= 1.5 - Authenticated(Contributor+) Local File Inclusion via shortcode	CVE-2023-45652	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	October 12, 2023
ProfileGrid <= 5.1.7 - Authenticated (Subscriber+) CSV Injection	CVE-2022-41791	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	November 17, 2022
CarDealerPress <= 6.6.2410.02 - Reflected Cross-Site Scripting	CVE-2024-54325	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 11, 2024
Media Downloader <= 0.4.7.4 - Reflected Cross-Site Scripting	CVE-2024-54322	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 11, 2024
SMSify <= 6.0.4 - Reflected Cross-Site Scripting	CVE-2024-54324	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 11, 2024
LDD Directory Lite <= 3.3 - Reflected Cross-Site Scripting	CVE-2024-54288	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 11, 2024
Dynamic URL SEO <= 1.0 - Unauthenticated Cross-Site Scripting	CVE-2024-52470	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
Open edX LMS <= 2.6.1 - Reflected Cross-Site Scripting	CVE-2024-52452	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
Explara Events <= 0.1.3 - Reflected Cross-Site Scripting	CVE-2024-52466	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
GoQMieruca <= 1.0.0 - Reflected Cross-Site Scripting	CVE-2024-52454	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
GoQSmile <= 1.0.1 - Reflected Cross-Site Scripting	CVE-2024-52455	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting	CVE-2024-52453	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
Post By Email <= 1.0.4b - Reflected Cross-Site Scripting	CVE-2024-52463	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
WooCommerce Price Alert <= 1.0.4 - Reflected Cross-Site Scripting	CVE-2024-52469	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 18, 2024
Dashing Memberships <= 1.1 - Reflected Cross-Site Scripting	CVE-2024-51760	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 4, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation