Wordfence Intelligence   >   Vulnerability Researchers   >   stealthcopter

stealthcopter

9
All Time Ranking
276
All Time Discoveries
74
90 Day Published Submissions
12 Sep '24
Last Published Submission

9 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
June 5, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
May 21, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
May 9, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
April 19, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
April 18, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
March 8, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
February 20, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 22, 2024
Learn more Learn more about Achievements

Showing 241-260 of 276 Vulnerabilities

Import XML and RSS Feeds <= 2.1.5 - Authenticated (Administrator+) Arbitrary File Upload
9.1
CVE-2024-31292
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
WP Photo Album Plus <= 8.6.03.004 - Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-31286
Apr 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
WordPress Tag and Category Manager – AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-2830
Apr 3, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
6.4
CVE-2024-2475
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
SellKit <= 1.8.1 - Authenticated (Subscriber+) Arbitrary File Download
6.5
CVE-2024-30509
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload
10.0
CVE-2024-30510
Mar 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Product Import Export for WooCommerce <= 2.4.1 - Authenticated(Shop Manager+) Arbitrary File Upload
7.2
CVE-2024-30231
Mar 26, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg <= 3.3.3 - Unauthenticated PHP Object Injection
9.8
CVE-2024-30226
Mar 26, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name
6.4
CVE-2024-2347
Mar 25, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode
6.4
CVE-2024-2871
Mar 25, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Mar 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name
6.4
CVE-2024-2500
Mar 21, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Passwordless Login <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-29143
Mar 18, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Link Library <= 7.6 - Reflected Cross-Site Scripting
6.1
CVE-2024-29123
Mar 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Coupon Affiliates <= 5.12.7 - Reflected Cross-Site Scripting
6.1
CVE-2024-29125
Mar 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_address
6.1
CVE-2024-2198
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Zippy <= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload
7.2
CVE-2024-27964
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AntiSpam for Contact Form 7 <= 0.6.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-27961
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Crisp <= 0.44 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-27963
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Email Subscription Popup <= 1.2.20 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2024-27960
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Import XML and RSS Feeds <= 2.1.5 - Authenticated (Administrator+) Arbitrary File Upload CVE-2024-31292 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H April 5, 2024
WP Photo Album Plus <= 8.6.03.004 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-31286 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H April 5, 2024
WordPress Tag and Category Manager – AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-2830 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 3, 2024
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode CVE-2024-2475 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 28, 2024
SellKit <= 1.8.1 - Authenticated (Subscriber+) Arbitrary File Download CVE-2024-30509 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N March 28, 2024
Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload CVE-2024-30510 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H March 28, 2024
Product Import Export for WooCommerce <= 2.4.1 - Authenticated(Shop Manager+) Arbitrary File Upload CVE-2024-30231 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H March 26, 2024
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg <= 3.3.3 - Unauthenticated PHP Object Injection CVE-2024-30226 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H March 26, 2024
Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name CVE-2024-2347 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 25, 2024
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode CVE-2024-2871 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 25, 2024
Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site Scripting 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 22, 2024
ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name CVE-2024-2500 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 21, 2024
Passwordless Login <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-29143 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 18, 2024
Link Library <= 7.6 - Reflected Cross-Site Scripting CVE-2024-29123 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 16, 2024
Coupon Affiliates <= 5.12.7 - Reflected Cross-Site Scripting CVE-2024-29125 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 16, 2024
Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_address CVE-2024-2198 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 13, 2024
Zippy <= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload CVE-2024-27964 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H March 13, 2024
AntiSpam for Contact Form 7 <= 0.6.0 - Reflected Cross-Site Scripting CVE-2024-27961 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 13, 2024
Crisp <= 0.44 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-27963 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N March 13, 2024
Email Subscription Popup <= 1.2.20 - Unauthenticated Stored Cross-Site Scripting CVE-2024-27960 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 13, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation