zaim

zaim is a security researcher credited with 232 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #40 of 3,515 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2025, with 146 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 222 of their findings (96%). Other recurring categories include PHP Remote File Inclusion, Missing Authorization. The average CVSS score across these disclosures is 6.4, peaking at 8.8. Severity breakdown: 0 critical and 9 high.

The most affected software includes Ultimate Blocks (5), Responsive Blocks (4), SKT Blocks (4), across 201 distinct plugins, themes and core versions in total.

176 of the 232 disclosed issues have a vendor fix, while 56 remain unpatched. The most severe finding, "MediaPress <= 1.5.9.1 - Authenticated (Contributor+) Local File Inclusion", scores 8.8 out of 10.

202420252026

Critical

High

Medium

Low

Global Rank

#40

of 3,515 researchers

Vulns

232

Critical0

High9

Medium223

Low0

Affected Assets

201

201plugins

Avg CVSS

6.4

Average score of vulnerabilities

Researcher Submissions

232 records


2026-09-10 14:34	Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Bold Timeline Lite <= 1.2.8	`CVE-2026-7438`	6.4 Medium	zaim	Yes
2026-08-04 18:10	SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting SKT Skill Bar <= 2.6	`CVE-2026-6972`	6.4 Medium	zaim	Yes
2026-08-04 17:52	Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Simple Yearly Archive <= 2.2.4	`CVE-2026-7441`	6.4 Medium	zaim	Yes
2026-07-28 21:22	WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute WPC Badge Management for WooCommerce <= 3.1.6	`CVE-2026-7436`	6.4 Medium	zaim	Yes
2026-07-22 00:00	Hubbub Lite <= 1.36.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Hubbub Lite <= 1.36.3	`CVE-2026-27403`	6.4 Medium	zaim	Yes
2026-07-13 13:11	WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute WP Customer Area <= 8.3.5	`CVE-2026-7640`	6.4 Medium	zaim	Yes
2026-07-10 17:21	fresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes fresh Podcaster <= 1.0.7	`CVE-2026-1382`	6.4 Medium	zaim	No
2026-07-09 20:51	Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget Jeg Kit for Elementor <= 3.2.6	`CVE-2026-13710`	6.4 Medium	zaim	Yes
2026-07-08 17:50	Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Bookero.pl <= 2.2	`CVE-2026-6910`	6.4 Medium	zaim	Yes
2026-07-07 23:10	Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode Website Builder by SeedProd <= 6.20.2	`CVE-2025-14785`	6.4 Medium	zaim	Yes

Showing 1–10 of 232 reports