ifoundbug

20252026

Critical

High

Medium

Low

Global Rank

#278

of 3,213 researchers

Vulns

16

Critical4

High6

Medium6

Low0

Affected Assets

10

10plugins

Avg CVSS

7.2

Average score of vulnerabilities

Researcher Submissions

16 records


2026-02-13 16:21	Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage Magic Login Mail or QR Code <= 2.05	`CVE-2026-2144`	8.1 High	ifoundbug	Yes
2026-01-06 19:59	ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure ShareThis Dashboard for Google Analytics <= 3.2.4	`CVE-2025-12540`	4.7 Medium	ifoundbug	No
2025-12-12 18:31	URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection URL Shortener Plugin For WordPress <= 3.0.7	`CVE-2025-10738`	9.8 Critical	ifoundbug	No
2025-11-20 18:41	ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload ELEX WordPress HelpDesk & Customer Tick… <= 3.3.1	`CVE-2025-11456`	9.8 Critical	ifoundbug	Yes
2025-11-04 17:38	File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure File Manager for Google Drive <= 1.5.3	`CVE-2025-12139`	7.5 High	ifoundbug	Yes
2025-10-31 16:03	Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting Community Events <= 1.5.2	`CVE-2025-11995`	7.2 High	ifoundbug	Yes
2025-10-23 20:11	URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation URL Shortener Plugin For WordPress <= 3.0.7	`CVE-2025-10740`	6.3 Medium	ifoundbug	No
2025-10-14 20:03	DocoDoco Store Locator <= 1.0.1 - Authenticated (Editor+) Arbitrary File Upload DocoDoco Store Locator <= 1.0.1	`CVE-2025-10754`	7.2 High	ifoundbug	No
2025-10-14 20:02	Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting Find And Replace content for WordPress <= 1.1	`CVE-2025-10313`	7.2 High	ifoundbug	No
2025-10-08 13:32	Community Events <= 1.5.1 - Unauthenticated SQL Injection Community Events <= 1.5.1	`CVE-2025-10586`	9.8 Critical	ifoundbug	Yes

Showing 1–10 of 16 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C