🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Rafshanzani Suhada

Rafshanzani Suhada

All Time Ranking

101

All Time Discoveries

90 Day Published Submissions

4 Nov '24

Last Published Submission

5 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

Showing 81-100 of 101 Vulnerabilities

ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting

4.4

CVE-2022-47613

Jan 27, 2023

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Zotpress <= 7.3.12 - Missing Authorization

4.3

CVE-2024-7429

Nov 4, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Simple Sitemap <= 3.5.13 - Cross-Site Request Forgery via admin_notices

4.3

CVE-2023-6492

Jun 13, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification

4.3

CVE-2023-6491

Jun 6, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save

4.3

CVE-2023-6493

Jan 4, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions

4.3

CVE-2023-47557

Nov 7, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Popup by Supsystic <= 1.10.19 - Missing Authorization to Sensitive Information Exposure

4.3

CVE-2023-46197

Oct 18, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Super Socializer <= 7.13.54 - Missing Authorization

4.3

CVE-2023-41802

Sep 5, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Super Socializer <= 7.13.54 - Cross-Site Request Forgery

4.3

CVE-2023-41802

Sep 5, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Automatic YouTube Gallery <= 2.3.3 - Missing Authorization via AJAX actions

4.3

CVE-2023-41866

Sep 5, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview

4.3

CVE-2023-33994

Aug 22, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Simple URLs <= 117 - Missing Authorization via AJAX actions

4.3

CVE-2023-40678

Aug 21, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation

4.3

CVE-2023-35093

Jun 15, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Photo Gallery <= 1.8.15 - Missing Authorization

4.3

CVE-2023-33995

Jun 2, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Layer Slider <= 1.1.9.7 - Cross-Site Request Forgery via save_slide_ajax

4.3

CVE-2023-23671

Apr 19, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Simple Job Board <= 2.10.3 - Cross-Site Request Forgery via sjb_save_settings_section

4.3

CVE-2023-29440

Apr 7, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.3

CVE-2023-25993

Feb 20, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

WP Client Reports <= 1.0.16 - Missing Authorization to Sensitive Information Exposure

4.3

CVE-2023-23978

Jan 20, 2023

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

WP Airbnb Review Slider <= 3.2 - Cross-Site Request Forgery

4.3

CVE-2023-23890

Jan 20, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AutomatorWP <= 2.5.0 - Cross Site Request Forgery

4.3

CVE-2023-23992

Jan 20, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting	CVE-2022-47613	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	January 27, 2023
Zotpress <= 7.3.12 - Missing Authorization	CVE-2024-7429	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	November 4, 2024
Simple Sitemap <= 3.5.13 - Cross-Site Request Forgery via admin_notices	CVE-2023-6492	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	June 13, 2024
Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification	CVE-2023-6491	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	June 6, 2024
Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save	CVE-2023-6493	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	January 4, 2024
Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions	CVE-2023-47557	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	November 7, 2023
Popup by Supsystic <= 1.10.19 - Missing Authorization to Sensitive Information Exposure	CVE-2023-46197	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	October 18, 2023
Super Socializer <= 7.13.54 - Missing Authorization	CVE-2023-41802	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	September 5, 2023
Super Socializer <= 7.13.54 - Cross-Site Request Forgery	CVE-2023-41802	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	September 5, 2023
Automatic YouTube Gallery <= 2.3.3 - Missing Authorization via AJAX actions	CVE-2023-41866	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	September 5, 2023
Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview	CVE-2023-33994	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 22, 2023
Simple URLs <= 117 - Missing Authorization via AJAX actions	CVE-2023-40678	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 21, 2023
MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation	CVE-2023-35093	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	June 15, 2023
Photo Gallery <= 1.8.15 - Missing Authorization	CVE-2023-33995	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	June 2, 2023
Layer Slider <= 1.1.9.7 - Cross-Site Request Forgery via save_slide_ajax	CVE-2023-23671	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 19, 2023
Simple Job Board <= 2.10.3 - Cross-Site Request Forgery via sjb_save_settings_section	CVE-2023-29440	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 7, 2023
Top 10 – Popular posts plugin for WordPress <= 3.2.3 - Missing Authorization on tptn_ajax_clearcache	CVE-2023-25993	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	February 20, 2023
WP Client Reports <= 1.0.16 - Missing Authorization to Sensitive Information Exposure	CVE-2023-23978	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	January 20, 2023
WP Airbnb Review Slider <= 3.2 - Cross-Site Request Forgery	CVE-2023-23890	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	January 20, 2023
AutomatorWP <= 2.5.0 - Cross Site Request Forgery	CVE-2023-23992	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	January 20, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation