💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > ZhongFu Su

ZhongFu Su

All Time Ranking

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

Showing 41-60 of 82 Vulnerabilities

WP Extra File Types <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

8.8

CVE-2021-24936

Dec 27, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection

7.2

CVE-2021-24865

Dec 24, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.24 - Reflected Cross-Site Scripting

6.1

CVE-2021-24923

Dec 23, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Easy Forms for Mailchimp <= 6.8.5 - Reflected Cross-Site Scripting

6.1

CVE-2021-24985

Dec 21, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Paid Memberships Pro <= 2.6.5 - Reflected Cross-Site Scripting

6.1

CVE-2021-24979

Nov 23, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

Nov 23, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WPFront User Role Editor <= 3.2.0 - Reflected Cross-Site Scripting

6.1

CVE-2021-24984

Nov 23, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Gwolle Guestbook <= 4.1.2 - Reflected Cross-Site Scripting

6.1

CVE-2021-24980

Nov 23, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Everest Forms <= 1.7.9 - Reflected Cross-Site Scripting

6.1

CVE-2021-24907

Nov 22, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Ni WooCommerce Custom Order Status <= 1.9.6 - SQL Injection

8.8

CVE-2021-24846

Nov 22, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting

6.1

CVE-2021-24956

Nov 22, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Icegram <= 2.0.4 - Reflected Cross-Site Scripting via message_id

6.1

CVE-2021-24941

Nov 22, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WCFM - WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection

9.8

CVE-2021-24849

Nov 22, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting

6.4

CVE-2021-24982

Nov 18, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter

6.1

CVE-2021-24954

Nov 15, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Auto Featured Image <= 3.9.2 - Reflected Cross-Site Scripting

6.1

CVE-2021-24932

Nov 15, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Quotes Collection <= 2.5.2 - Authenticated (Admin+) SQL Injection

7.2

CVE-2021-24861

Nov 15, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Pixel Cat Lite <= 2.6.2 - Admin+ Stored Cross-Site Scripting

4.8

CVE-2021-24972

Nov 15, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots < 6.67 - Unauthenticated SQL Injection

9.8

CVE-2021-24863

Nov 15, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mediamatic – Media Library Folders <= 2.8.0 - SQL Injection

8.8

CVE-2021-24848

Nov 15, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
WP Extra File Types <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting	CVE-2021-24936	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	December 27, 2021
Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection	CVE-2021-24865	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	December 24, 2021
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.24 - Reflected Cross-Site Scripting	CVE-2021-24923	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 23, 2021
Easy Forms for Mailchimp <= 6.8.5 - Reflected Cross-Site Scripting	CVE-2021-24985	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 21, 2021
Paid Memberships Pro <= 2.6.5 - Reflected Cross-Site Scripting	CVE-2021-24979	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 23, 2021
WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting		6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 23, 2021
WPFront User Role Editor <= 3.2.0 - Reflected Cross-Site Scripting	CVE-2021-24984	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 23, 2021
Gwolle Guestbook <= 4.1.2 - Reflected Cross-Site Scripting	CVE-2021-24980	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 23, 2021
Everest Forms <= 1.7.9 - Reflected Cross-Site Scripting	CVE-2021-24907	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 22, 2021
Ni WooCommerce Custom Order Status <= 1.9.6 - SQL Injection	CVE-2021-24846	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	November 22, 2021
Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting	CVE-2021-24956	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 22, 2021
Icegram <= 2.0.4 - Reflected Cross-Site Scripting via message_id	CVE-2021-24941	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 22, 2021
WCFM - WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection	CVE-2021-24849	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 22, 2021
Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting	CVE-2021-24982	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	November 18, 2021
ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter	CVE-2021-24954	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 15, 2021
Auto Featured Image <= 3.9.2 - Reflected Cross-Site Scripting	CVE-2021-24932	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 15, 2021
Quotes Collection <= 2.5.2 - Authenticated (Admin+) SQL Injection	CVE-2021-24861	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 15, 2021
Pixel Cat Lite <= 2.6.2 - Admin+ Stored Cross-Site Scripting	CVE-2021-24972	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	November 15, 2021
WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots < 6.67 - Unauthenticated SQL Injection	CVE-2021-24863	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 15, 2021
Mediamatic – Media Library Folders <= 2.8.0 - SQL Injection	CVE-2021-24848	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	November 15, 2021

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation