🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > RE-ALTER

RE-ALTER

All Time Ranking

280

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

About

𝕯𝖎𝖘𝖙𝖚𝖗𝖇 𝖙𝖍𝖊 𝕻𝖊𝖆𝖈𝖊 // Darkness lurking below the surface?

Showing 121-140 of 280 Vulnerabilities

eRoom – Zoom Meetings & Webinar <= 1.3.7 - Cross-Site Request Forgery

4.3

CVE-2022-25614

Apr 11, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery

4.3

CVE-2022-27846

Apr 11, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting

6.4

CVE-2022-25613

Apr 4, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Simple Event Planner plugin <= 1.5.4 - Cross-Site Scripting

4.1

CVE-2022-25612

Mar 23, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Contact Form X <= 2.4 - Reflected Cross-Site Scripting

6.1

CVE-2022-25601

Feb 25, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery

5.4

CVE-2022-25600

Feb 22, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Contact Form Submissions <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2022-0248

Feb 21, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

YOP Poll <= 6.3.4 - Author+ Stored Cross-Site Scripting

6.4

CVE-2022-0205

Feb 14, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Spiffy Calendar <= 4.9.0 - Edit/Delete event via IDOR

6.3

CVE-2022-29434

Feb 10, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Contact Form & Lead Form Elementor Builder < 1.7.4 - Arbitrary Settings Change

6.3

CVE-2022-23180

Feb 1, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

[GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

8.8

CVE ID Unknown

Jan 27, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Access Demo Importer <= 1.0.7 - Cross-Site Request Forgery to Data Reset

8.1

CVE-2022-23976

Jan 24, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Shield Security <= 13.0.5 - Admin+ Stored Cross-Site Scripting

5.5

CVE-2022-0211

Jan 19, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Better Messages <= 1.9.9.148 - Cross-Site Request Forgery

8.8

CVE-2022-36389

Jan 18, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Form Store to DB <= 1.1.0 - Stored Cross-Site Scripting

6.1

CVE-2021-25107

Jan 17, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WP-DownloadManager plugin <= 1.68.6 - Stored Cross-Site Scripting

4.8

CVE-2022-25605

Jan 12, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery

8.8

CVE ID Unknown

Jan 11, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation

8.8

CVE-2022-23975

Jan 11, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WP-DownloadManager <= 1.68.6 - Stored Cross-Site Scripting

4.8

CVE-2022-25606

Jan 10, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Ivory Search <= 5.4 - Multiple Admin+ Stored Cross-Site Scripting

4.8

CVE-2021-25105

Jan 10, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
eRoom – Zoom Meetings & Webinar <= 1.3.7 - Cross-Site Request Forgery	CVE-2022-25614	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 11, 2022
Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery	CVE-2022-27846	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 11, 2022
FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting	CVE-2022-25613	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	April 4, 2022
Simple Event Planner plugin <= 1.5.4 - Cross-Site Scripting	CVE-2022-25612	4.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N	March 23, 2022
Contact Form X <= 2.4 - Reflected Cross-Site Scripting	CVE-2022-25601	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 25, 2022
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery	CVE-2022-25600	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L	February 22, 2022
Contact Form Submissions <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting	CVE-2022-0248	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	February 21, 2022
YOP Poll <= 6.3.4 - Author+ Stored Cross-Site Scripting	CVE-2022-0205	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	February 14, 2022
Spiffy Calendar <= 4.9.0 - Edit/Delete event via IDOR	CVE-2022-29434	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	February 10, 2022
Contact Form & Lead Form Elementor Builder < 1.7.4 - Arbitrary Settings Change	CVE-2022-23180	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	February 1, 2022
[GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting		8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	January 27, 2022
Access Demo Importer <= 1.0.7 - Cross-Site Request Forgery to Data Reset	CVE-2022-23976	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H	January 24, 2022
Shield Security <= 13.0.5 - Admin+ Stored Cross-Site Scripting	CVE-2022-0211	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	January 19, 2022
Better Messages <= 1.9.9.148 - Cross-Site Request Forgery	CVE-2022-36389	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	January 18, 2022
Form Store to DB <= 1.1.0 - Stored Cross-Site Scripting	CVE-2021-25107	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 17, 2022
WP-DownloadManager plugin <= 1.68.6 - Stored Cross-Site Scripting	CVE-2022-25605	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	January 12, 2022
AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery		8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	January 11, 2022
AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation	CVE-2022-23975	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	January 11, 2022
WP-DownloadManager <= 1.68.6 - Stored Cross-Site Scripting	CVE-2022-25606	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	January 10, 2022
Ivory Search <= 5.4 - Multiple Admin+ Stored Cross-Site Scripting	CVE-2021-25105	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	January 10, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation