🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Rafie Muhammad

Rafie Muhammad

Organization: Patchstack

All Time Ranking

559

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

Showing 321-340 of 559 Vulnerabilities

Multiple Plugins by Crocoblock <= (Various Versions) - Cross-Site Request Forgery

4.3

CVE-2023-48762

Nov 28, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

JetBlocks For Elementor <= 1.3.8 - Reflected Cross Site Scripting

6.1

CVE-2023-48756

Nov 28, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

JetElements For Elementor <= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download

5.3

CVE-2023-48759

Nov 28, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Mollie Payments for WooCommerce <= 7.3.11 - Authenticated (Shop Manager+) Arbitrary File Upload

7.2

CVE-2023-6090

Nov 27, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Salient Core <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-48749

Nov 24, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Salient Core <= 2.0.2 - Reflected Cross-Site Scripting

6.1

CVE-2023-48748

Nov 24, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Yoast SEO <= 21.0 - Authenticated (Seo Manager+) Stored Cross-Site Scripting

5.5

CVE-2023-40680

Nov 24, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Porto Theme - Functionality <= 2.11.1 - Missing Authorization

5.3

CVE-2023-48739

Nov 23, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Porto Theme - Functionality <= 2.11.1 - Unauthenticated SQL Injection

9.8

CVE-2023-48738

Nov 23, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Enfold <= 5.6.4 - Reflected Cross-Site Scripting

6.1

CVE-2023-38400

Nov 23, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload

6.6

CVE-2023-48275

Nov 22, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Deletion

6.5

CVE-2023-47843

Nov 20, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload

7.2

CVE-2023-47842

Nov 20, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

WP Githuber MD <= 1.16.2 - Authenticated (Author+) Arbitrary File Upload

8.8

CVE-2023-47846

Nov 20, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints

4.3

CVE-2023-47788

Nov 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection

5.0

CVE-2023-47774

Nov 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute

6.4

CVE-2023-45050

Nov 16, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Phlox Shop <= 2.0.0 - Unauthenticated Local File Inclusion

9.8

CVE-2023-39163

Nov 15, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Phlox Portfolio <= 2.3.1 - Unauthenticated Local File Inclusion

9.8

CVE-2023-38399

Nov 15, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Shortcodes and extra features for Phlox theme <= 2.14.0 - Unauthenticated Local File Inclusion

9.8

CVE-2023-37888

Nov 15, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
Multiple Plugins by Crocoblock <= (Various Versions) - Cross-Site Request Forgery	CVE-2023-48762	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 28, 2023
JetBlocks For Elementor <= 1.3.8 - Reflected Cross Site Scripting	CVE-2023-48756	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 28, 2023
JetElements For Elementor <= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download	CVE-2023-48759	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	November 28, 2023
Mollie Payments for WooCommerce <= 7.3.11 - Authenticated (Shop Manager+) Arbitrary File Upload	CVE-2023-6090	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 27, 2023
Salient Core <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-48749	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 24, 2023
Salient Core <= 2.0.2 - Reflected Cross-Site Scripting	CVE-2023-48748	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 24, 2023
Yoast SEO <= 21.0 - Authenticated (Seo Manager+) Stored Cross-Site Scripting	CVE-2023-40680	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	November 24, 2023
Porto Theme - Functionality <= 2.11.1 - Missing Authorization	CVE-2023-48739	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	November 23, 2023
Porto Theme - Functionality <= 2.11.1 - Unauthenticated SQL Injection	CVE-2023-48738	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 23, 2023
Enfold <= 5.6.4 - Reflected Cross-Site Scripting	CVE-2023-38400	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 23, 2023
Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload	CVE-2023-48275	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	November 22, 2023
CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Deletion	CVE-2023-47843	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H	November 20, 2023
CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload	CVE-2023-47842	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 20, 2023
WP Githuber MD <= 1.16.2 - Authenticated (Author+) Arbitrary File Upload	CVE-2023-47846	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	November 20, 2023
Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints	CVE-2023-47788	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	November 16, 2023
Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection	CVE-2023-47774	5.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N	November 16, 2023
Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute	CVE-2023-45050	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 16, 2023
Phlox Shop <= 2.0.0 - Unauthenticated Local File Inclusion	CVE-2023-39163	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 15, 2023
Phlox Portfolio <= 2.3.1 - Unauthenticated Local File Inclusion	CVE-2023-38399	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 15, 2023
Shortcodes and extra features for Phlox theme <= 2.14.0 - Unauthenticated Local File Inclusion	CVE-2023-37888	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 15, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation