Wordfence Intelligence   >   Vulnerability Researchers   >   Rafie Muhammad

Rafie Muhammad

Organization: Patchstack

2
All Time Ranking
538
All Time Discoveries
0
90 Day Published Submissions
N/A
Last Published Submission

Showing 441-460 of 538 Vulnerabilities

Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection
5.0
CVE-2023-47774
Nov 16, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
GiveWP <= 2.20.2 - Authenticated Arbitrary File Read
4.9
CVE-2022-31475
Jul 12, 2022
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
WooCommerce Ship to Multiple Addresses <= 3.8.5 - Reflected Cross-Site Scripting
4.4
CVE-2023-37873
Jul 10, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
WooCommerce Multilingual & Multicurrency <= 5.3.6 - Missing Authorization
4.3
CVE-2024-44006
Sep 16, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Email Address Encoder <= 1.0.23 - Cross-Site Request Forgery via eae_clear_caches()
4.3
CVE-2024-43927
Aug 26, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Envira Photo Gallery <= 1.8.14 - Missing Authorization
4.3
CVE-2024-43925
Aug 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Missing Authorization
4.3
CVE-2024-43932
Aug 26, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Presto Player <= 3.0.2 - Missing Authorization
4.3
CVE-2024-43285
Aug 16, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SpeedyCache <= 1.1.8 - Cross-Site Request Forgery
4.3
CVE-2024-43299
Aug 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.82 - Cross-Site Request Forgery
4.3
CVE-2024-43287
Aug 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Stripe Payments For WooCommerce by Checkout <= 1.9.1 - Cross-Site Request Forgery
4.3
CVE-2024-43316
Aug 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Meta Box – WordPress Custom Fields Framework <= 5.9.10 - Missing Authorization to Information Exposure
4.3
CVE-2024-43235
Aug 9, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Simple Local Avatars <= 2.7.10 - Cross-Site Request Forgery via save_default_avatar_file_id()
4.3
CVE-2024-43116
Aug 7, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Hummingbird <= 3.9.1 - Missing Authorization
4.3
CVE-2024-43118
Aug 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Hummingbird <= 3.9.1 - Cross-Site Request Forgery
4.3
CVE-2024-43117
Aug 7, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
AMP for WP <= 1.0.96.1 - Missing Authorization
4.3
CVE-2024-43146
Aug 7, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Tutor LMS <= 2.7.2 - Cross-Site Request Forgery
4.3
CVE-2024-39645
Aug 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery
4.3
CVE-2024-39641
Aug 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Ninja Forms <= 3.8.6 - Cross-Site Request Forgery
4.3
CVE-2024-39628
Jul 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Security Optimizer – The All-In-One Protection Plugin <= 1.5.0 - Missing Authorization via hide_notice()
4.3
CVE-2024-38774
Jul 19, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection CVE-2023-47774 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N November 16, 2023
GiveWP <= 2.20.2 - Authenticated Arbitrary File Read CVE-2022-31475 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N July 12, 2022
WooCommerce Ship to Multiple Addresses <= 3.8.5 - Reflected Cross-Site Scripting CVE-2023-37873 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N July 10, 2023
WooCommerce Multilingual & Multicurrency <= 5.3.6 - Missing Authorization CVE-2024-44006 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 16, 2024
Email Address Encoder <= 1.0.23 - Cross-Site Request Forgery via eae_clear_caches() CVE-2024-43927 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 26, 2024
Envira Photo Gallery <= 1.8.14 - Missing Authorization CVE-2024-43925 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N August 26, 2024
The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Missing Authorization CVE-2024-43932 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N August 26, 2024
Presto Player <= 3.0.2 - Missing Authorization CVE-2024-43285 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N August 16, 2024
SpeedyCache <= 1.1.8 - Cross-Site Request Forgery CVE-2024-43299 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 16, 2024
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.82 - Cross-Site Request Forgery CVE-2024-43287 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 16, 2024
Stripe Payments For WooCommerce by Checkout <= 1.9.1 - Cross-Site Request Forgery CVE-2024-43316 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 16, 2024
Meta Box – WordPress Custom Fields Framework <= 5.9.10 - Missing Authorization to Information Exposure CVE-2024-43235 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N August 9, 2024
Simple Local Avatars <= 2.7.10 - Cross-Site Request Forgery via save_default_avatar_file_id() CVE-2024-43116 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 7, 2024
Hummingbird <= 3.9.1 - Missing Authorization CVE-2024-43118 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N August 7, 2024
Hummingbird <= 3.9.1 - Cross-Site Request Forgery CVE-2024-43117 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 7, 2024
AMP for WP <= 1.0.96.1 - Missing Authorization CVE-2024-43146 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N August 7, 2024
Tutor LMS <= 2.7.2 - Cross-Site Request Forgery CVE-2024-39645 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 1, 2024
LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery CVE-2024-39641 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N August 1, 2024
Ninja Forms <= 3.8.6 - Cross-Site Request Forgery CVE-2024-39628 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N July 24, 2024
Security Optimizer – The All-In-One Protection Plugin <= 1.5.0 - Missing Authorization via hide_notice() CVE-2024-38774 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N July 19, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation