Wordfence Intelligence   >   Vulnerability Researchers   >   Krzysztof Zając

Krzysztof Zając

Organization: CERT PL

3
All Time Ranking
415
All Time Discoveries
21
90 Day Published Submissions
18 Sep '24
Last Published Submission

About

Finding WordPress vulnerabilities using https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html

9 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 22, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
April 4, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 19, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 27, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
February 9, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 23, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 2, 2024
Learn more Learn more about Achievements

Showing 321-340 of 415 Vulnerabilities

WP RSS Aggregator <= 4.19.2 - Subscriber+ Stored Cross-Site Scripting
5.4
CVE-2021-24988
Nov 29, 2021
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Meks Easy Photo Feed Widget < 1.2.4 - Authenticated Stored Cross-Site Scripting
5.4
CVE-2021-24958
Nov 10, 2021
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
My Calendar <= 3.2.17 - Subscriber+ Reflected Cross-Site Scripting
5.4
CVE-2021-24927
Nov 1, 2021
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Premium SEO Pack – WP SEO Plugin <= 1.6.001 - Unauthenticated Information Exposure
5.3
CVE-2024-3679
Aug 28, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure
5.3
CVE-2024-3228
Jul 8, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization
5.3
CVE-2024-5545
Jul 1, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SEO SIMPLE PACK <= 3.2.1 - Information Exposure
5.3
CVE-2024-2795
Jun 27, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-5615
Jun 4, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WPUpper Share Buttons <= 3.43 - Missing Authorization
5.3
CVE-2024-4997
Jun 3, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Reset
5.3
CVE-2024-4280
May 9, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization
5.3
CVE-2024-2797
Apr 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display
5.3
CVE-2024-2109
Apr 29, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure
5.3
CVE-2024-3678
Apr 25, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure
5.3
CVE-2024-3897
Apr 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Send PDF for Contact Form 7 <= 1.0.2.3 - Missing Authorization
5.3
CVE-2024-3585
Apr 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization
5.3
CVE-2024-3287
Apr 19, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration
5.3
CVE-2024-3601
Apr 18, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposure
5.3
CVE-2024-3312
Apr 18, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSL Zen – Free Let&#039;s Encrypt SSL Certificate & HTTPS/SSL Redirect WordPress Plugin <= 4.5.0 - Sensitive Information Exposure
5.3
CVE-2024-1076
Apr 17, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
5.3
CVE-2024-3599
Apr 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Title CVE ID CVSS Vector Date
WP RSS Aggregator <= 4.19.2 - Subscriber+ Stored Cross-Site Scripting CVE-2021-24988 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N November 29, 2021
Meks Easy Photo Feed Widget < 1.2.4 - Authenticated Stored Cross-Site Scripting CVE-2021-24958 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N November 10, 2021
My Calendar <= 3.2.17 - Subscriber+ Reflected Cross-Site Scripting CVE-2021-24927 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N November 1, 2021
Premium SEO Pack – WP SEO Plugin <= 1.6.001 - Unauthenticated Information Exposure CVE-2024-3679 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N August 28, 2024
Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure CVE-2024-3228 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N July 8, 2024
Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization CVE-2024-5545 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 1, 2024
SEO SIMPLE PACK <= 3.2.1 - Information Exposure CVE-2024-2795 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N June 27, 2024
Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure CVE-2024-5615 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N June 4, 2024
WPUpper Share Buttons <= 3.43 - Missing Authorization CVE-2024-4997 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N June 3, 2024
White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Reset CVE-2024-4280 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N May 9, 2024
MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization CVE-2024-2797 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 29, 2024
Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display CVE-2024-2109 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 29, 2024
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure CVE-2024-3678 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 25, 2024
Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure CVE-2024-3897 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 24, 2024
Send PDF for Contact Form 7 <= 1.0.2.3 - Missing Authorization CVE-2024-3585 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 23, 2024
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization CVE-2024-3287 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N April 19, 2024
Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration CVE-2024-3601 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 18, 2024
Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposure CVE-2024-3312 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 18, 2024
SSL Zen – Free Let&#039;s Encrypt SSL Certificate & HTTPS/SSL Redirect WordPress Plugin <= 4.5.0 - Sensitive Information Exposure CVE-2024-1076 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 17, 2024
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion CVE-2024-3599 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L April 16, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation