Saadiqbal vulnerabilities

Products

• Points Management System For Gamification, Ranks, Badges, And Loyalty Rewards Program – Mycred 9
• Advanced File Manager – Ultimate File Manager For Wordpress And Document Library Solution 8
• Password Protected — Lock Entire Site, Pages, Posts, Categories, And Partial Content 5
• Wp Easy Pay – Payment And Donation Form Builder For Square 5
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, And Custom Form Builder 3
• New User Approve 3
• Post Snippets – Custom Wordpress Code Snippets Customizer 3
• Email Templates Customizer And Designer For Wordpress And Woocommerce 2
• License Manager For Woocommerce 2
• Quick Contact Form 2
• Wholesale For Woocommerce 2

Newest

• saadiqbal email templates customizer and designer for wordpress and woocommerce Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter CVE-2026-107630 7.5 HighOctober 30, 2026
• saadiqbal password protected – protect your site content with a password Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler CVE-2026-93293 6.4 MediumOctober 29, 2026
• saadiqbal post snippets – custom wordpress code snippets customizer Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-77871 6.4 MediumOctober 28, 2026
• saadiqbal post smtp – complete email delivery and smtp solution with email logs, alerts, backup smtp & mobile app Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log) CVE-2026-75962 7.2 HighOctober 6, 2026
• saadiqbal wp easy pay – payment and donation form builder for square WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion CVE-2026-12739 4.3 MediumSeptember 18, 2026
• saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute CVE-2026-17149 6.4 MediumSeptember 9, 2026
• saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter CVE-2026-15009 6.1 MediumAugust 16, 2026
• saadiqbal password protected — lock entire site, pages, posts, categories, and partial content Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API CVE-2026-14943 7.5 HighAugust 7, 2026
• saad iqbal gutena forms – contact form, survey form, feedback form, booking form, and custom form builder WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability CVE-2026-66425 6.5 MediumAugust 6, 2026
• saadiqbal wpformify – stripe payments with form and checkout WPFormify <= 1.1.1 - Missing Authorization CVE-2026-6627 8.2 HighAugust 5, 2026
• saadiqbal gutena forms – contact form, survey form, feedback form, booking form, and custom form builder Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_b… CVE-2026-11995 5.3 MediumAugust 1, 2026
• saadiqbal wholesale for woocommerce Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter CVE-2026-12144 8.8 HighJuly 29, 2026
• saadiqbal wp easy pay – payment and donation form builder for square WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action CVE-2026-12738 4.3 MediumJuly 11, 2026
• saadiqbal user management User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification CVE-2026-12097 5.3 MediumJuly 8, 2026
• saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute CVE-2026-8607 6.4 MediumJune 17, 2026
• saadiqbal post snippets – custom wordpress code snippets customizer Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import CVE-2026-7430 4.4 MediumMay 29, 2026
• 100plugins open user map, 5starplugins dynamic copyright year, easy age verify +128 more +130 more Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 MediumMay 1, 2026
• saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' CVE-2026-3090 7.2 HighMarch 18, 2026
• saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite CVE-2026-2559 5.3 MediumMarch 18, 2026
• saadiqbal gutena forms – contact form, survey form, feedback form, booking form, and custom form builder Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema() CVE-2026-1674 6.5 MediumMarch 4, 2026
• saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode CVE-2026-0550 6.4 MediumFebruary 14, 2026
• saad iqbal new user approve New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure CVE-2026-0832 7.3 HighJanuary 28, 2026
• saad iqbal quick contact form Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay CVE-2025-12718 5.8 MediumJanuary 17, 2026
• saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure CVE-2025-12361 4.3 MediumDecember 19, 2025
• saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval CVE-2025-12362 5.3 MediumDecember 13, 2025
• saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update CVE-2025-12887 5.4 MediumDecember 3, 2025
• saad iqbal new user approve New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling CVE-2025-12770 5.3 MediumNovember 19, 2025
• saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure CVE-2025-11833 Public exploit EPSS 61.5% 9.8 CriticalNovember 1, 2025
• saadiqbal password protected — lock entire site, pages, posts, categories, and partial content Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing CVE-2025-11244 3.7 LowOctober 25, 2025
• saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update CVE-2025-9219 4.3 MediumSeptember 3, 2025
• file manager pro, ninja team file manager pro, ninjateam file manager pro – filester +1 more +3 more Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion CVE-2025-0818 6.5 MediumAugust 13, 2025
• saadiqbal password protected — lock entire site, pages, posts, categories, and partial content Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposure CVE-2025-3453 5.3 MediumApril 17, 2025
• wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 more Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter CVE-2024-13844 4.9 MediumMarch 8, 2025
• advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 more Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload CVE-2024-13805 6.4 MediumMarch 7, 2025
• saadiqbal wpexperts square for givewp, wpexperts givewp square +1 more WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection CVE-2024-13713 6.5 MediumFebruary 21, 2025
• wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 more Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting CVE-2025-0521 7.2 HighFebruary 18, 2025
• advancedfilemanager advanced file manager, saadiqbal advanced file manager — ultimate wordpress file manager and document library plugin +1 more Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-13333 7.5 HighJanuary 17, 2025
• saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode CVE-2024-11201 Public exploit 6.4 MediumDecember 6, 2024
• advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 more Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-11391 7.5 HighDecember 3, 2024
• mycred, saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred +1 more myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode CVE-2024-10187 6.4 MediumNovember 8, 2024
• 5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 more Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 MediumOctober 16, 2024
• advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 more Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload CVE-2024-8725 6.8 MediumSeptember 26, 2024
• advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 more Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale CVE-2024-8704 7.2 HighSeptember 26, 2024
• advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 more Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-8126 7.5 HighSeptember 26, 2024
• mycred, saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycred +1 more myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Author… CVE-2024-8658 5.3 MediumSeptember 25, 2024
• wpeasypay wp easypay, saadiqbal wp easy pay – payment and donation form builder for square +1 more WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection CVE-2024-5861 5.3 MediumJuly 24, 2024
• advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 more Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing CVE-2024-5598 7.5 HighJune 29, 2024
• saad iqbal license manager for woocommerce License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure CVE-2024-1639 6.5 MediumJune 21, 2024
• wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 more POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection CVE-2024-5207 7.2 HighMay 30, 2024
• saadiqbal password protected — lock entire site, pages, posts, categories, and partial content Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure CVE-2024-0437 4.3 MediumMay 14, 2024
• Show olderLoading…