Afifudin Maarif

Afifudin Maarif is a security researcher credited with 5 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #798 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 4 of their findings (80%). Other recurring categories include Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 7.5, peaking at 8.8. Severity breakdown: 0 critical and 5 high.

The most affected software includes EU VAT Assistant for WooCommerce (1), Magic Tooltips For Contact Form 7 (1), No External Links (1), across 5 distinct plugins, themes and core versions in total.

All 5 disclosed issues have since received a vendor fix. The most severe finding, "Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter", scores 8.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#798

of 3,823 researchers

Vulns

Critical0

High5

Medium0

Low0

Affected Assets

5plugins

Avg CVSS

7.5

Average score of vulnerabilities

Researcher Submissions

5 records


2026-10-16 14:38	EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter EU VAT Assistant for WooCommerce <= 2.1.30.260413	`CVE-2026-103899`	7.2 High	Afifudin Maarif	Yes
2026-10-02 16:39	Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author Magic Tooltips For Contact Form 7 <= 1.0.34	`CVE-2026-101928`	7.2 High	Afifudin Maarif	Yes
2026-10-01 19:17	No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect No External Links <= 5.2.0	`CVE-2026-95670`	7.2 High	Afifudin Maarif	Yes
2026-08-31 20:54	Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter Welcart e-Commerce <= 2.12.1	`CVE-2026-19914`	7.2 High	Afifudin Maarif	Yes
2026-07-09 15:29	Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter Salon Booking System <= 10.30.32	`CVE-2026-15070`	8.8 High	Afifudin Maarif	Yes

Showing 1–5 of 5 reports