ZAST.AI

ZAST.AI is a security researcher credited with 16 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #307 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 12 findings.

Their research concentrates on Cross-Site Scripting, which accounts for 11 of their findings (69%). Other recurring categories include Code Injection, Unrestricted Upload Of File With Dangerous Type. The average CVSS score across these disclosures is 6.1, peaking at 9.8. Severity breakdown: 1 critical and 4 high.

The most affected software includes Content Visibility for Divi Builder (2), Allow HTML in Category Descriptions (1), Double the Donation (1), across 15 distinct plugins, themes and core versions in total.

10 of the 16 disclosed issues have a vendor fix, while 6 remain unpatched. The most severe finding, "Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#307

of 3,515 researchers

Vulns

Critical1

High4

Medium11

Low0

Affected Assets

15plugins

Avg CVSS

6.1

Average score of vulnerabilities

Researcher Submissions

16 records


2026-07-10 14:46	Print, PDF, Email by PrintFriendly <= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' Parameter Print, PDF & Email by PrintFriendly <= 5.5.10	`CVE-2026-9738`	4.4 Medium	ZAST.AI	Yes
2026-07-07 16:31	Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values Sympl Repeater for ACF and Elementor <= 2.3	`CVE-2026-10570`	6.4 Medium	ZAST.AI	No
2026-06-04 00:00	Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution Content Visibility for Divi Builder <= 4.02	`CVE-2026-1829`	8.8 High	ZAST.AI	Yes
2026-06-02 05:02	Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution Content Visibility for Divi Builder <= 4.02	`CVE-2026-1829`	8.8 High	ZAST.AI	Yes
2026-05-28 17:02	StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname StatCounter <= 2.1.1	`CVE-2026-6275`	6.4 Medium	ZAST.AI	Yes
2026-05-26 13:53	Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute Splide Carousel Block <= 1.7.1	`CVE-2026-9022`	6.4 Medium	ZAST.AI	Yes
2026-03-06 11:26	Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting Easy PHP Settings <= 1.0.4	`CVE-2026-3352`	7.2 High	ZAST.AI	Yes
2026-02-18 15:54	Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload Slider Future <= 1.0.5	`CVE-2026-1405`	9.8 Critical	ZAST.AI	No
2026-02-13 18:33	Link Hopper <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter Link Hopper <= 2.5	`CVE-2025-15483`	4.4 Medium	ZAST.AI	No
2026-02-13 18:18	Allow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions Allow HTML in Category Descriptions <= 1.2.4	`CVE-2026-0693`	4.4 Medium	ZAST.AI	Yes

Showing 1–10 of 16 reports