Wordfence Intelligence   >   Vulnerability Researchers   >   Krzysztof Zając

Krzysztof Zając

Organization: CERT PL

3
All Time Ranking
415
All Time Discoveries
21
90 Day Published Submissions
18 Sep '24
Last Published Submission

About

Finding WordPress vulnerabilities using https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html

9 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 22, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
April 4, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 19, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 27, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
February 9, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 23, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 2, 2024
Learn more Learn more about Achievements

Showing 241-260 of 415 Vulnerabilities

Icegram Express <= 5.4.19 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2022-3981
Nov 21, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Five Star Restaurant Reservations <= 2.4.11 - Missing Authorization to Stored Cross-Site Scripting
7.2
CVE-2022-0421
Oct 31, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Easy Digital Downloads <= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post Deletion
8.8
CVE-2022-2387
Oct 17, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP Popup Builder <= 1.2.9 - Missing Authorization and Cross-Site Request Forgery
7.5
CVE-2022-2405
Sep 5, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
WP Popup Builder <= 1.2.8 - Reflected Cross-Site Scripting
6.1
CVE-2022-2404
Sep 5, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Visual Portfolio, Photo Gallery & Post Grid <= 2.18.0 - Contributor+ CSS Injection
4.3
CVE-2022-2597
Aug 15, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Visual Portfolio, Photo Gallery & Post Grid <= 2.17.1 - Unauthenticated CSS Injection
5.3
CVE-2022-2543
Aug 15, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Directorist <= 7.3.0 - Sensitive Information Disclosure
7.5
CVE-2022-2376
Aug 10, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
WP Hide & Security Enhancer <= 1.7.9.2 - Reflected Cross-Site Scripting
6.1
CVE-2022-2538
Aug 8, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WooCommerce PDF Invoices & Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting
6.1
CVE-2022-2537
Aug 3, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Sticky Button <= 1.4 - Missing Authorization to Arbitrary Settings Update
6.3
CVE-2022-2375
Aug 1, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Subscriber+ Stored Cross-Site Scripting
6.1
CVE-2022-2532
Jul 26, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Product Slider for WooCommerce <= 2.5.6 - Missing Authorization
5.4
CVE-2022-2382
Jul 26, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Directorist – WordPress Business Directory Plugin with Classified Ads Listings <= 7.2.3 - Missing Authorization
6.3
CVE-2022-2377
Jul 26, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
WP Coder <= 2.5.2 - Cross-Site Request Forgery
8.8
CVE-2022-2388
Jul 26, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Abandoned Cart Recovery for WooCommerce by Autonami <= 2.1.1 - Missing Authorization
6.3
CVE-2022-2389
Jul 15, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
WP Accessibility Helper <= 0.6.0.6 - Reflected Cross-Site Scripting via wahi
6.1
CVE-2022-0150
Jun 20, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.16 - Unauthenticated Plugin Settings Reset
9.8
CVE-2022-0444
Jun 6, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Like Button Rating ♥ LikeBtn <= 2.6.44 - Arbitrary e-mail Sending
5.0
CVE-2022-0745
May 23, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
XML Sitemap Generator for Google <= 2.0.3 - Reflected Cross-Site Scripting
6.1
CVE-2022-0346
May 2, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
Icegram Express <= 5.4.19 - Authenticated (Subscriber+) SQL Injection CVE-2022-3981 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H November 21, 2022
Five Star Restaurant Reservations <= 2.4.11 - Missing Authorization to Stored Cross-Site Scripting CVE-2022-0421 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N October 31, 2022
Easy Digital Downloads <= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post Deletion CVE-2022-2387 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 17, 2022
WP Popup Builder <= 1.2.9 - Missing Authorization and Cross-Site Request Forgery CVE-2022-2405 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N September 5, 2022
WP Popup Builder <= 1.2.8 - Reflected Cross-Site Scripting CVE-2022-2404 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N September 5, 2022
Visual Portfolio, Photo Gallery & Post Grid <= 2.18.0 - Contributor+ CSS Injection CVE-2022-2597 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N August 15, 2022
Visual Portfolio, Photo Gallery & Post Grid <= 2.17.1 - Unauthenticated CSS Injection CVE-2022-2543 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N August 15, 2022
Directorist <= 7.3.0 - Sensitive Information Disclosure CVE-2022-2376 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N August 10, 2022
WP Hide & Security Enhancer <= 1.7.9.2 - Reflected Cross-Site Scripting CVE-2022-2538 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N August 8, 2022
WooCommerce PDF Invoices & Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting CVE-2022-2537 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N August 3, 2022
WP Sticky Button <= 1.4 - Missing Authorization to Arbitrary Settings Update CVE-2022-2375 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L August 1, 2022
Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Subscriber+ Stored Cross-Site Scripting CVE-2022-2532 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 26, 2022
Product Slider for WooCommerce <= 2.5.6 - Missing Authorization CVE-2022-2382 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L July 26, 2022
Directorist – WordPress Business Directory Plugin with Classified Ads Listings <= 7.2.3 - Missing Authorization CVE-2022-2377 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L July 26, 2022
WP Coder <= 2.5.2 - Cross-Site Request Forgery CVE-2022-2388 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H July 26, 2022
Abandoned Cart Recovery for WooCommerce by Autonami <= 2.1.1 - Missing Authorization CVE-2022-2389 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L July 15, 2022
WP Accessibility Helper <= 0.6.0.6 - Reflected Cross-Site Scripting via wahi CVE-2022-0150 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N June 20, 2022
Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.16 - Unauthenticated Plugin Settings Reset CVE-2022-0444 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H June 6, 2022
Like Button Rating ♥ LikeBtn <= 2.6.44 - Arbitrary e-mail Sending CVE-2022-0745 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N May 23, 2022
XML Sitemap Generator for Google <= 2.0.3 - Reflected Cross-Site Scripting CVE-2022-0346 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N May 2, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation