zickzick2

zickzick2 is a security researcher credited with 13 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #391 of 3,866 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 5 of their findings (38%). Other recurring categories include SQL Injection, Improper Privilege Management. The average CVSS score across these disclosures is 7.6, peaking at 9.8. Severity breakdown: 2 critical and 7 high.

The most affected software includes Appointment Booking Plugin (1), bbp style pack (1), Gmedia Photo Gallery (1), across 13 distinct plugins, themes and core versions in total.

11 of the 13 disclosed issues have a vendor fix, while 2 remain unpatched. The most severe finding, "Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#391

of 3,866 researchers

Vulns

Critical2

High7

Medium4

Low0

Affected Assets

13plugins

Avg CVSS

7.6

Average score of vulnerabilities

Researcher Submissions

13 records


2026-10-13 15:41	NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String NewStatPress <= 1.4.5	`CVE-2026-101924`	7.2 High	zickzick2	No
2026-10-13 15:37	Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter Gmedia Photo Gallery <= 1.25.1	`CVE-2026-96661`	7.5 High	zickzick2	No
2026-10-09 19:23	Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter Appointment Booking Plugin <= 5.7.2	`CVE-2026-96662`	7.5 High	zickzick2	Yes
2026-10-09 17:45	VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter VikBooking Hotel Booking Engine & PMS <= 1.8.15	`CVE-2026-95684`	7.2 High	zickzick2	Yes
2026-10-09 17:15	HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format HivePress <= 1.7.31	`CVE-2026-103520`	6.4 Medium	zickzick2	Yes
2026-10-02 17:35	VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter VikAppointments Services Booking… <= 1.2.21	`CVE-2026-87115`	9.1 Critical	zickzick2	Yes
2026-09-30 20:12	bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name bbp style pack <= 6.4.8	`CVE-2026-101925`	6.4 Medium	zickzick2	Yes
2026-09-30 19:18	Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter Ultimate Multisite <= 2.15.0	`CVE-2026-75957`	9.8 Critical	zickzick2	Yes
2026-09-29 19:39	WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter WP Directory Kit <= 1.5.4	`CVE-2026-16596`	6.5 Medium	zickzick2	Yes
2026-09-18 19:22	Quill Forms \| Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value Quill Forms <= 5.7.1	`CVE-2026-15664`	7.2 High	zickzick2	Yes

Showing 1–10 of 13 reports