Wordfence Intelligence   >   Vulnerability Researchers   >   Krzysztof Zając

Krzysztof Zając

Organization: CERT PL

3
All Time Ranking
415
All Time Discoveries
21
90 Day Published Submissions
18 Sep '24
Last Published Submission

About

Finding WordPress vulnerabilities using https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html

9 Achievements

Learn more about Achievements
Submitted XSS Vulnerability
Submitted XSS Vulnerability
September 4, 2024
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
April 22, 2024
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
April 4, 2024
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
March 19, 2024
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
February 27, 2024
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
February 9, 2024
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
January 23, 2024
1337 Vulnerability Researcher
1337 Vulnerability Researcher
January 2, 2024
Submitted 1 Vulnerability
Submitted 1 Vulnerability
January 2, 2024
Learn more Learn more about Achievements

Showing 361-380 of 415 Vulnerabilities

Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount()
5.3
CVE-2024-0617
Jan 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug
5.3
CVE-2023-7014
Jan 16, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access
5.3
CVE-2023-7199
Jan 4, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Getwid – Gutenberg Blocks <= 2.0.2 - Improper Input Validation to Arbitrary Email Sending to Admin
5.3
CVE-2023-6042
Dec 15, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
WP VR <= 8.3.14 - Missing Authorization to Plugin Version Downgrade
5.3
CVE-2023-6529
Dec 14, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Simple Social Media Share Buttons <= 5.1.0 - Unauthenticated Password Protected Post Disclosure
5.3
CVE-2023-5845
Dec 6, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Royal Elementor Addons and Templates <= 1.3.80 - Missing Authorization to Private/Password Protected Post Read
5.3
CVE-2023-5922
Dec 6, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Quiz Maker <= 6.4.9.4 - Missing Authorization to Email Disclosure
5.3
CVE-2023-6155
Nov 30, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
BestWebSoft's Like & Share <= 2.73 - Unauthenticated Password Protected Post Disclosure
5.3
CVE-2023-6250
Nov 29, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Swift Performance Lite <= 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export
5.3
CVE-2023-6289
Nov 27, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Simple Social Media Share Buttons <= 3.8.2 - Unauthenticated Password Protected Post Disclosure
5.3
CVE-2023-5949
Nov 23, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The Events Calendar <= 6.2.8 - Information Disclosure
5.3
CVE-2023-6203
Nov 20, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion
5.3
CVE-2023-5651
Oct 20, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Qubely – Advanced Gutenberg Blocks <= 1.8.5 - Insufficient Authorization
5.3
CVE-2021-24916
Jul 17, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Visual Portfolio, Photo Gallery & Post Grid <= 2.17.1 - Unauthenticated CSS Injection
5.3
CVE-2022-2543
Aug 15, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CMP - Coming Soon & Maintenance Plugin <= 4.0.18 - Unauthenticated Arbitrary CSS Update
5.3
CVE-2022-0188
Jan 17, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Link Library <= 7.2.7 - Missing Authorization Checks
5.3
CVE-2021-25093
Dec 30, 2021
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Like Button Rating ♥ LikeBtn <= 2.6.44 - Arbitrary e-mail Sending
5.0
CVE-2022-0745
May 23, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
WooCommerce PDF Invoices & Packing Slips <= 2.10.4 - Reflected Cross-Site Scripting via tab and section parameter
4.8
CVE-2021-24991
Dec 6, 2021
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 10.23 - Missing Authorization to Information Expsoure
4.3
CVE-2024-4355
May 29, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Title CVE ID CVSS Vector Date
Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount() CVE-2024-0617 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 24, 2024
Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug CVE-2023-7014 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N January 16, 2024
Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access CVE-2023-7199 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N January 4, 2024
Getwid – Gutenberg Blocks <= 2.0.2 - Improper Input Validation to Arbitrary Email Sending to Admin CVE-2023-6042 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N December 15, 2023
WP VR <= 8.3.14 - Missing Authorization to Plugin Version Downgrade CVE-2023-6529 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N December 14, 2023
Simple Social Media Share Buttons <= 5.1.0 - Unauthenticated Password Protected Post Disclosure CVE-2023-5845 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 6, 2023
Royal Elementor Addons and Templates <= 1.3.80 - Missing Authorization to Private/Password Protected Post Read CVE-2023-5922 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N December 6, 2023
Quiz Maker <= 6.4.9.4 - Missing Authorization to Email Disclosure CVE-2023-6155 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 30, 2023
BestWebSoft's Like & Share <= 2.73 - Unauthenticated Password Protected Post Disclosure CVE-2023-6250 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 29, 2023
Swift Performance Lite <= 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export CVE-2023-6289 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 27, 2023
Simple Social Media Share Buttons <= 3.8.2 - Unauthenticated Password Protected Post Disclosure CVE-2023-5949 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 23, 2023
The Events Calendar <= 6.2.8 - Information Disclosure CVE-2023-6203 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N November 20, 2023
WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion CVE-2023-5651 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N October 20, 2023
Qubely – Advanced Gutenberg Blocks <= 1.8.5 - Insufficient Authorization CVE-2021-24916 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N July 17, 2023
Visual Portfolio, Photo Gallery & Post Grid <= 2.17.1 - Unauthenticated CSS Injection CVE-2022-2543 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N August 15, 2022
CMP - Coming Soon & Maintenance Plugin <= 4.0.18 - Unauthenticated Arbitrary CSS Update CVE-2022-0188 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 17, 2022
Link Library <= 7.2.7 - Missing Authorization Checks CVE-2021-25093 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N December 30, 2021
Like Button Rating ♥ LikeBtn <= 2.6.44 - Arbitrary e-mail Sending CVE-2022-0745 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N May 23, 2022
WooCommerce PDF Invoices & Packing Slips <= 2.10.4 - Reflected Cross-Site Scripting via tab and section parameter CVE-2021-24991 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N December 6, 2021
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 10.23 - Missing Authorization to Information Expsoure CVE-2024-4355 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N May 29, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation