Wordfence Intelligence   >   Vulnerability Researchers   >   Krzysztof Zając

Krzysztof Zając

Organization: CERT PL

3
All Time Ranking
415
All Time Discoveries
21
90 Day Published Submissions
18 Sep '24
Last Published Submission

About

Finding WordPress vulnerabilities using https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html

9 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 22, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
April 4, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 19, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 27, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
February 9, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 23, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 2, 2024
Learn more Learn more about Achievements

Showing 221-240 of 415 Vulnerabilities

Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-0821
Feb 20, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-0665
Jan 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Advanced Schedule Posts <= 2.1.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-0249
Jan 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Analytics Insights <= 6.2 - Open Redirect
6.1
CVE-2024-0250
Jan 17, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting
6.1
CVE-2023-6981
Jan 2, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Get Use APIs – JSON Content Importer <= 1.5.3 - Reflected Cross-Site Scripting
6.1
CVE-2023-6268
Dec 4, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting
6.1
CVE-2023-5749
Nov 17, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via 'rt'
6.1
CVE-2023-5609
Oct 27, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Photo Gallery <= 1.8.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2022-4058
Nov 28, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Popup Builder <= 1.2.8 - Reflected Cross-Site Scripting
6.1
CVE-2022-2404
Sep 5, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Hide & Security Enhancer <= 1.7.9.2 - Reflected Cross-Site Scripting
6.1
CVE-2022-2538
Aug 8, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WooCommerce PDF Invoices & Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting
6.1
CVE-2022-2537
Aug 3, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Subscriber+ Stored Cross-Site Scripting
6.1
CVE-2022-2532
Jul 26, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Accessibility Helper <= 0.6.0.6 - Reflected Cross-Site Scripting via wahi
6.1
CVE-2022-0150
Jun 20, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
XML Sitemap Generator for Google <= 2.0.3 - Reflected Cross-Site Scripting
6.1
CVE-2022-0346
May 2, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Nimble Page Builder <= 3.2.1 - Reflected Cross-Site Scripting
6.1
CVE-2022-0314
Apr 8, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Content Egg <= 5.3.0 - Reflected Cross-Site Scripting
6.1
CVE-2022-0428
Apr 6, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api
6.1
CVE-2022-0879
Mar 28, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Favicon by RealFaviconGenerator <= 1.3.22 - Reflected Cross-Site Scripting
6.1
CVE-2022-0471
Mar 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Migration, Backup, Staging – WPvivid <= 0.9.69 - Reflected Cross-Site Scripting via sub_page Parameter
6.1
CVE-2022-0531
Mar 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting CVE-2024-0821 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N February 20, 2024
WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting CVE-2024-0665 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 23, 2024
Advanced Schedule Posts <= 2.1.8 - Reflected Cross-Site Scripting CVE-2024-0249 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 23, 2024
Analytics Insights <= 6.2 - Open Redirect CVE-2024-0250 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 17, 2024
WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting CVE-2023-6981 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N January 2, 2024
Get Use APIs – JSON Content Importer <= 1.5.3 - Reflected Cross-Site Scripting CVE-2023-6268 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N December 4, 2023
EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting CVE-2023-5749 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N November 17, 2023
Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via 'rt' CVE-2023-5609 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N October 27, 2023
Photo Gallery <= 1.8.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2022-4058 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N November 28, 2022
WP Popup Builder <= 1.2.8 - Reflected Cross-Site Scripting CVE-2022-2404 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N September 5, 2022
WP Hide & Security Enhancer <= 1.7.9.2 - Reflected Cross-Site Scripting CVE-2022-2538 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N August 8, 2022
WooCommerce PDF Invoices & Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting CVE-2022-2537 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N August 3, 2022
Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Subscriber+ Stored Cross-Site Scripting CVE-2022-2532 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 26, 2022
WP Accessibility Helper <= 0.6.0.6 - Reflected Cross-Site Scripting via wahi CVE-2022-0150 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N June 20, 2022
XML Sitemap Generator for Google <= 2.0.3 - Reflected Cross-Site Scripting CVE-2022-0346 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N May 2, 2022
Nimble Page Builder <= 3.2.1 - Reflected Cross-Site Scripting CVE-2022-0314 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 8, 2022
Content Egg <= 5.3.0 - Reflected Cross-Site Scripting CVE-2022-0428 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 6, 2022
Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api CVE-2022-0879 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 28, 2022
Favicon by RealFaviconGenerator <= 1.3.22 - Reflected Cross-Site Scripting CVE-2022-0471 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 21, 2022
Migration, Backup, Staging – WPvivid <= 0.9.69 - Reflected Cross-Site Scripting via sub_page Parameter CVE-2022-0531 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N March 21, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation