Stiofan

Stiofan is a security researcher credited with 11 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #398 of 3,515 contributors. Their disclosures were published between 2021 and 2025. The most productive year was 2025, with 7 findings.

Their research concentrates on Missing Authorization, which accounts for 4 of their findings (36%). Other recurring categories include Cross-Site Scripting, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 6.9, peaking at 9.8. Severity breakdown: 2 critical and 2 high.

The most affected software includes Gallery (2), Sandbox (2), Youzify (2), across 8 distinct plugins, themes and core versions in total.

9 of the 11 disclosed issues have a vendor fix, while 2 remain unpatched. The most severe finding, "Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation", scores 9.8 out of 10.

20212022202320242025

Critical

High

Medium

Low

Global Rank

#398

of 3,515 researchers

Vulns

Critical2

High2

Medium7

Low0

Affected Assets

9plugins

Avg CVSS

6.9

Average score of vulnerabilities

Researcher Submissions

11 records


2025-03-07 16:21	FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size Gallery <= 2.4.29	`CVE-2024-12119`	6.4 Medium	Stiofan	Yes
2025-03-07 16:21	FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates Gallery <= 2.4.29	`CVE-2024-12114`	4.3 Medium	Stiofan	Yes
2025-01-29 00:00	W2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read W2S <= 1.2.1	`CVE-2024-12861`	6.5 Medium	Stiofan	Yes
2025-01-24 18:53	Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license) Youzify <= 1.3.3	`CVE-2024-13370`	6.5 Medium	Stiofan	Yes
2025-01-24 18:53	Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update Youzify <= 1.3.4	`CVE-2024-13368`	4.3 Medium	Stiofan	Yes
2025-01-16 18:24	Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download Sandbox <= 0.4	`CVE-2024-13367`	6.5 Medium	Stiofan	No
2025-01-16 00:00	Sandbox <= 0.4 - Reflected Cross-Site Scripting Sandbox <= 0.4	`CVE-2024-13366`	6.1 Medium	Stiofan	No
2024-04-19 00:00	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation User Registration & Membership <= 3.1.5	`CVE-2024-2417`	8.8 High	Stiofan	Yes
2024-03-13 00:00	Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation Web Application Firewall <= 2.1.1	`CVE-2024-2172`	9.8 Critical	Stiofan	Yes
2021-08-09 00:00	Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting Paid Membership Plugin <= 3.1.10	`CVE-2021-24522`	7.2 High	Stiofan	Yes

Showing 1–10 of 11 reports