Wordfence Intelligence   >   Vulnerability Researchers   >   Krzysztof Zając

Krzysztof Zając

Organization: CERT PL

3
All Time Ranking
415
All Time Discoveries
21
90 Day Published Submissions
18 Sep '24
Last Published Submission

About

Finding WordPress vulnerabilities using https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html

9 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 22, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
April 4, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 19, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 27, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
February 9, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 23, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 2, 2024
Learn more Learn more about Achievements

Showing 181-200 of 415 Vulnerabilities

Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting
6.5
CVE-2024-0678
Jan 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation
6.5
CVE-2023-6985
Jan 25, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()
5.3
CVE-2024-0617
Jan 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount()
5.3
CVE-2024-0617
Jan 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-0665
Jan 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Advanced Schedule Posts <= 2.1.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-0249
Jan 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
easy.jobs <= 2.4.6 - Missing Authorization to Settings Update
6.5
CVE-2023-6843
Jan 21, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Analytics Insights <= 6.2 - Open Redirect
6.1
CVE-2024-0250
Jan 17, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug
5.3
CVE-2023-7014
Jan 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Contact Form 7 Connector <= 1.2.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
4.3
CVE-2024-0239
Jan 10, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP Customer Area <= 8.2.0 - Insecure Direct Object Reference to Account Address Disclosure
4.3
CVE-2023-6824
Jan 10, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
WP Customer Area <= 8.2.1 - Insecure Direct Object Reference to Address Modification
4.3
CVE-2023-6741
Jan 10, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access
5.3
CVE-2023-7199
Jan 4, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css
9.1
CVE-2023-6699
Jan 3, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion
4.3
CVE-2023-6980
Jan 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting
6.1
CVE-2023-6981
Jan 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Estatik Real Estate Plugin <= 4.1.0 - Unauthenticated PHP Object Injection
9.8
CVE-2023-6049
Dec 25, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estatik Real Estate Plugin <= 4.1.0 - Missing Authorization to Limited Arbitrary Options Update
5.4
CVE-2023-6048
Dec 25, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Missing Authorization to Blog Data Export
4.3
CVE-2023-5905
Dec 21, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Essential Real Estate <= 4.3.5 - Missing Authorization to Denial of Service
5.4
CVE-2023-6139
Dec 18, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Title CVE ID CVSS Vector Date
Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting CVE-2024-0678 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N January 29, 2024
10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation CVE-2023-6985 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N January 25, 2024
Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount() CVE-2024-0617 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 24, 2024
Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount() CVE-2024-0617 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 24, 2024
WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting CVE-2024-0665 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 23, 2024
Advanced Schedule Posts <= 2.1.8 - Reflected Cross-Site Scripting CVE-2024-0249 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 23, 2024
easy.jobs <= 2.4.6 - Missing Authorization to Settings Update CVE-2023-6843 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N January 21, 2024
Analytics Insights <= 6.2 - Open Redirect CVE-2024-0250 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 17, 2024
Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug CVE-2023-7014 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N January 16, 2024
Contact Form 7 Connector <= 1.2.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting CVE-2024-0239 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 10, 2024
WP Customer Area <= 8.2.0 - Insecure Direct Object Reference to Account Address Disclosure CVE-2023-6824 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N January 10, 2024
WP Customer Area <= 8.2.1 - Insecure Direct Object Reference to Address Modification CVE-2023-6741 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 10, 2024
Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access CVE-2023-7199 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N January 4, 2024
WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css CVE-2023-6699 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N January 3, 2024
WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion CVE-2023-6980 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 2, 2024
WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting CVE-2023-6981 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 2, 2024
Estatik Real Estate Plugin <= 4.1.0 - Unauthenticated PHP Object Injection CVE-2023-6049 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 25, 2023
Estatik Real Estate Plugin <= 4.1.0 - Missing Authorization to Limited Arbitrary Options Update CVE-2023-6048 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L December 25, 2023
DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Missing Authorization to Blog Data Export CVE-2023-5905 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N December 21, 2023
Essential Real Estate <= 4.3.5 - Missing Authorization to Denial of Service CVE-2023-6139 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L December 18, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation