Francesco Marano

Francesco Marano is a security researcher credited with 5 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #722 of 3,515 contributors. Their disclosures were published between 2022 and 2023. The most productive year was 2023, with 3 findings.

Their research concentrates on Code Injection, which accounts for 1 of their findings (20%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting. The average CVSS score across these disclosures is 8.2, peaking at 9.8. Severity breakdown: 1 critical and 3 high.

The most affected software includes WP All Export Pro (2), Build App Online (1), Campaign Monitor Forms by Optin Cat (1), across 4 distinct plugins, themes and core versions in total.

All 5 disclosed issues have since received a vendor fix. The most severe finding, "Build App Online <= 1.0.18 - Unauthenticated SQL Injection", scores 9.8 out of 10.

20222023

Critical

High

Medium

Low

Global Rank

#722

of 3,515 researchers

Vulns

Critical1

High3

Medium1

Low0

Affected Assets

5plugins

Avg CVSS

8.2

Average score of vulnerabilities

Researcher Submissions

5 records


2023-11-24 00:00	Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Authenticated (Admin+) Remote Code Execution WP All Export Pro < 1.8.6	`CVE-2023-4724`	6.4 Medium	Donato Di Pasquale	Yes
2023-11-24 00:00	Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Cross-Site Request Forgery to Remote Code Execution WP All Export Pro < 1.8.6	`CVE-2023-5882`	8.8 High	Donato Di Pasquale	Yes
2023-10-09 00:00	Campaign Monitor Forms <= 2.5.5 - Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice Campaign Monitor Forms by Optin Cat <= 2.5.5	`CVE-2023-5098`	7.1 High	Francesco Marano	Yes
2022-12-09 00:00	Visual Email Designer for WooCommerce <= 1.7.1 - Authenticated (Author+) SQL Injection Email Template Builder for WooCommerce… <= 1.7.1	`CVE-2022-3860`	8.8 High	Donato Di Pasquale	Yes
2022-12-06 00:00	Build App Online <= 1.0.18 - Unauthenticated SQL Injection Build App Online <= 1.0.18	`CVE-2022-3241`	9.8 Critical	Donato Di Pasquale	Yes

Showing 1–5 of 5 reports