Rasoul Jahanshahi

Rasoul Jahanshahi is a security researcher credited with 12 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #371 of 3,515 contributors. Their disclosures were published between 2022 and 2024. The most productive year was 2022, with 8 findings.

Their research concentrates on Deserialization Of Untrusted Data, which accounts for 11 of their findings (92%). Other recurring categories include Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 8.1, peaking at 9.8. Severity breakdown: 1 critical and 11 high.

The most affected software includes ImageMagick Engine (2), Ajax Load More (1), Broken Link Checker (1), across 11 distinct plugins, themes and core versions in total.

All 12 disclosed issues have since received a vendor fix. The most severe finding, "Feed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization", scores 9.8 out of 10.

202220232024

Critical

High

Medium

Low

Global Rank

#371

of 3,515 researchers

Vulns

Critical1

High11

Medium0

Low0

Affected Assets

11plugins

Avg CVSS

8.1

Average score of vulnerabilities

Researcher Submissions

12 records


2024-09-23 00:00	Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization Easy Digital Downloads <= 3.3.3	`CVE-2022-2439`	7.2 High	Rasoul Jahanshahi	Yes
2024-09-12 00:00	WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization WP Editor <= 1.2.9	`CVE-2022-2446`	7.2 High	Rasoul Jahanshahi	Yes
2024-08-28 00:00	Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization Theme Editor <= 2.8	`CVE-2022-2440`	7.2 High	Rasoul Jahanshahi	Yes
2023-02-09 00:00	ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization ImageMagick Engine <= 1.7.5	`CVE-2022-3568`	8.8 High	Rasoul Jahanshahi	Yes
2022-10-17 00:00	ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution ImageMagick Engine <= 1.7.5	`CVE-2022-2441`	8.8 High	Rasoul Jahanshahi	Yes
2022-08-22 00:00	WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization Ajax Load More <= 5.5.3	`CVE-2022-2433`	7.5 High	Rasoul Jahanshahi	Yes
2022-08-17 00:00	Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization Download Manager <= 3.2.49	`CVE-2022-2436`	8.8 High	Rasoul Jahanshahi	Yes
2022-08-10 00:00	Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization WPvivid <= 0.9.74	`CVE-2022-2442`	7.2 High	Rasoul Jahanshahi	Yes
2022-08-08 00:00	String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization String locator <= 2.5.0	`CVE-2022-2434`	8.8 High	Rasoul Jahanshahi	Yes
2022-07-18 00:00	Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization Broken Link Checker <= 1.11.16	`CVE-2022-2438`	7.2 High	Rasoul Jahanshahi	Yes

Showing 1–10 of 12 reports