🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Rafshanzani Suhada

Rafshanzani Suhada

All Time Ranking

101

All Time Discoveries

90 Day Published Submissions

4 Nov '24

Last Published Submission

5 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 41-60 of 101 Vulnerabilities

Form Builder <= 1.9.9.0 - Unauthenticated CSV Injection

8.3

CVE-2023-23796

Jun 28, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Layer Slider <= 1.1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-23798

Jun 28, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Email download link <= 3.7 - Unauthenticated Sensitive Information Exposure

6.5

CVE-2023-36523

Jun 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

MaxButtons <= 9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-36503

Jun 23, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Spam protection, AntiSpam, FireWall by CleanTalk <= 6.10 - Missing Authorization

6.3

CVE-2023-33996

Jun 22, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Form Builder <= 1.9.9.0 - Cross-Site Request Forgery

6.5

CVE-2023-23795

Jun 19, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Super Socializer <= 7.13.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-35882

Jun 19, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-35090

Jun 15, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation

4.3

CVE-2023-35093

Jun 15, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Photo Gallery <= 1.8.15 - Missing Authorization

4.3

CVE-2023-33995

Jun 2, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Groundhogg <= 2.7.11 - Cross-Site Request Forgery

5.4

CVE-2023-34178

May 30, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Groundhogg <= 2.7.11 - Authenticated (Administrator+) SQL Injection

7.2

CVE-2023-34179

May 30, 2023

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Layer Slider <= 1.1.9.7 - Cross-Site Request Forgery via save_slide_ajax

4.3

CVE-2023-23671

Apr 19, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Simple Job Board <= 2.10.3 - Cross-Site Request Forgery via sjb_save_settings_section

4.3

CVE-2023-29440

Apr 7, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

User Registration <= 2.3.2.1 - Missing Authorization via send_test_email

5.3

CVE-2023-29429

Apr 6, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Connections Business Directory <= 10.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

5.4

CVE-2023-29437

Apr 6, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Filebird <= 5.1.4 - Missing Authorization via resAdminPermissionsCheck

5.4

CVE-2023-25966

Mar 27, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Easy Table of Contents <= 2.0.45.2 - Missing Authorization via eztoc_reset_options_to_default

5.4

CVE-2023-25469

Mar 21, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Klaviyo <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-0874

Mar 20, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Data Tables Generator by Supsystic <= 1.10.25 - Missing Authorization

6.3

CVE-2023-25043

Mar 13, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Title	CVE ID	CVSS	Vector	Date
Form Builder <= 1.9.9.0 - Unauthenticated CSV Injection	CVE-2023-23796	8.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L	June 28, 2023
Layer Slider <= 1.1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-23798	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 28, 2023
Email download link <= 3.7 - Unauthenticated Sensitive Information Exposure	CVE-2023-36523	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	June 27, 2023
MaxButtons <= 9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-36503	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 23, 2023
Spam protection, AntiSpam, FireWall by CleanTalk <= 6.10 - Missing Authorization	CVE-2023-33996	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	June 22, 2023
Form Builder <= 1.9.9.0 - Cross-Site Request Forgery	CVE-2023-23795	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	June 19, 2023
Super Socializer <= 7.13.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-35882	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 19, 2023
MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-35090	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	June 15, 2023
MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation	CVE-2023-35093	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	June 15, 2023
Photo Gallery <= 1.8.15 - Missing Authorization	CVE-2023-33995	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	June 2, 2023
Groundhogg <= 2.7.11 - Cross-Site Request Forgery	CVE-2023-34178	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	May 30, 2023
Groundhogg <= 2.7.11 - Authenticated (Administrator+) SQL Injection	CVE-2023-34179	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	May 30, 2023
Layer Slider <= 1.1.9.7 - Cross-Site Request Forgery via save_slide_ajax	CVE-2023-23671	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 19, 2023
Simple Job Board <= 2.10.3 - Cross-Site Request Forgery via sjb_save_settings_section	CVE-2023-29440	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 7, 2023
User Registration <= 2.3.2.1 - Missing Authorization via send_test_email	CVE-2023-29429	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	April 6, 2023
Connections Business Directory <= 10.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-29437	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	April 6, 2023
Filebird <= 5.1.4 - Missing Authorization via resAdminPermissionsCheck	CVE-2023-25966	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	March 27, 2023
Easy Table of Contents <= 2.0.45.2 - Missing Authorization via eztoc_reset_options_to_default	CVE-2023-25469	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	March 21, 2023
Klaviyo <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-0874	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	March 20, 2023
Data Tables Generator by Supsystic <= 1.10.25 - Missing Authorization	CVE-2023-25043	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	March 13, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation