Krzysztof Zając

Krzysztof Zając is a security researcher credited with 465 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #14 of 3,515 contributors. Their disclosures were published between 2021 and 2026. The most productive year was 2024, with 206 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 193 of their findings (42%). Other recurring categories include Missing Authorization, SQL Injection. The average CVSS score across these disclosures is 6.5, peaking at 10.0. Severity breakdown: 35 critical and 87 high.

The most affected software includes Link Library (6), Awesome Support (4), Royal Addons for Elementor (4), across 370 distinct plugins, themes and core versions in total.

429 of the 465 disclosed issues have a vendor fix, while 36 remain unpatched. The most severe finding, "WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection", scores 10.0 out of 10.

202120222023202420252026

Critical

High

Medium

Low

Global Rank

#14

of 3,515 researchers

Vulns

465

Critical35

High87

Medium343

Low0

Affected Assets

374

369plugins5themes

Avg CVSS

6.5

Average score of vulnerabilities

Researcher Submissions

465 records


2026-08-15 20:14	Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection Contact Form <= 1.8.5	`CVE-2024-13784`	9.8 Critical	Krzysztof Zając	Yes
2026-03-20 15:21	Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.4 - Unauthenticated Blind Arbitrary Shortcode Execution Contact Form <= 1.7.4	`CVE-2024-13785`	5.6 Medium	Krzysztof Zając	Yes
2025-04-01 20:30	Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation Demo Awesome <= 1.0.3	`CVE-2024-13637`	6.5 Medium	Krzysztof Zając	No
2025-03-25 14:11	Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter Smart Maintenance Mode <= 1.5.2	`CVE-2025-1490`	6.1 Medium	Krzysztof Zając	Yes
2025-03-24 18:00	teachPress <= 9.0.9 - Cross-Site Request Forgery to Import Delete teachPress <= 9.0.9	`CVE-2025-1320`	4.3 Medium	Krzysztof Zając	Yes
2025-03-11 14:22	WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download WP Crowdfunding <= 2.1.14	`CVE-2025-1508`	5.3 Medium	Krzysztof Zając	Yes
2025-03-07 20:57	WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection WP-Recall <= 16.26.10	`CVE-2025-1323`	7.5 High	Krzysztof Zając	Yes
2025-03-07 20:52	WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction WP-Recall <= 16.26.10	`CVE-2025-1325`	6.3 Medium	Krzysztof Zając	Yes
2025-03-07 14:16	Shortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export Shortcode Cleaner Lite <= 1.0.9	`CVE-2025-1481`	6.5 Medium	Krzysztof Zając	No
2025-03-07 00:00	WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure WP-Recall <= 16.26.10	`CVE-2025-1322`	4.3 Medium	Krzysztof Zając	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 465 records. Every record has its own page and is listed in the sitemap.