Niraj Mahajan

Niraj Mahajan is a security researcher credited with 10 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #457 of 3,515 contributors. The disclosure was published in 2022.

Their research concentrates on Cross-Site Scripting, which accounts for 9 of their findings (90%). Other recurring categories include Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.7, peaking at 9.6. Severity breakdown: 1 critical and 0 high.

The most affected software includes Login with TOTP (Google Authenticator (2), Limit Login Attempts (1), Malware Scanner (1), across 9 distinct plugins, themes and core versions in total.

All 10 disclosed issues have since received a vendor fix. The most severe finding, "Login With OTP Over SMS, Email, WhatsApp and Google Authenticator <= 1.0.4 - Cross-Site Request Forgery to Cross-Site Scripting", scores 9.6 out of 10.

2022

Critical

High

Medium

Low

Global Rank

#457

of 3,515 researchers

Vulns

Critical1

High0

Medium9

Low0

Affected Assets

9plugins

Avg CVSS

5.7

Average score of vulnerabilities

Researcher Submissions

10 records


2022-06-06 00:00	Login With OTP Over SMS, Email, WhatsApp and Google Authenticator <= 1.0.4 - Cross-Site Request Forgery to Cross-Site Scripting Login with TOTP (Google Authenticator <= 1.0.4	`CVE-2022-0875`	9.6 Critical	Niraj Mahajan	Yes
2022-06-06 00:00	MiniOrange Limit Login Attempts <= 4.0.72 - Administrator+ Cross-Site Scripting Limit Login Attempts <= 4.0.71	`CVE-2022-1029`	4.8 Medium	Niraj Mahajan	Yes
2022-06-06 00:00	Login using WordPress Users (WP as SAML IDP) <= 1.13.2 - Authenticated (Admin+) Cross-Site Scripting SAML IDP (Identity Provider) <= 1.13.3	`CVE-2022-1010`	5.5 Medium	Niraj Mahajan	Yes
2022-06-06 00:00	Login With OTP Over SMS, Email, WhatsApp and Google Authenticator <= 1.0.7 - Cross-Site Scripting Login with TOTP (Google Authenticator <= 1.0.7	`CVE-2022-1994`	4.8 Medium	Niraj Mahajan	Yes
2022-06-06 00:00	miniOrange's Google Authenticator <= 5.5.5 - Authenticated (Admin+) Cross-Site Scripting miniOrange 2FA <= 5.5.5	`CVE-2022-1321`	5.5 Medium	Niraj Mahajan	Yes
2022-06-06 00:00	WordPress Security <= 4.2 - Admin+ Stored Cross-Site Scripting WordPress Security <= 4.2	`CVE-2022-1028`	6.1 Medium	Niraj Mahajan	Yes
2022-06-06 00:00	miniOrange’s Malware Scanner <= 4.5.5 - Cross-Site Scripting Malware Scanner <= 4.5.1	`CVE-2022-1995`	4.8 Medium	Niraj Mahajan	Yes
2022-05-09 00:00	User Meta <= 2.4.2 - Authenticated (Admin+) Cross-Site Scripting User Meta <= 2.4.2	`CVE-2022-0376`	5.5 Medium	Niraj Mahajan	Yes
2022-04-13 00:00	WP Social Buttons <= 2.1 - Admin+ Cross-Site Scripting WP Social Buttons <= 2.1	`CVE-2022-0874`	4.8 Medium	Niraj Mahajan	Yes
2022-04-09 00:00	Page Restriction WordPress <= 1.2.6 - Admin+ Stored Cross-Site Scripting Page and Post Restriction <= 1.2.6	`CVE-2022-1027`	5.5 Medium	Niraj Mahajan	Yes

Showing 1–10 of 10 reports