Skip to contentSyed Balkhi vulnerabilities
Newest
- awesomemotive contact form by wpformsWordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-548517.1 High
- syed balkhi envira galleryEnvira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST EndpointCVE-2026-1040795.3 Medium
- syed balkhi charitableWordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1043947.1 High
- syed balkhi giveaways and contests by rafflepressGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' ParameterCVE-2026-973186.1 Medium
- syed balkhi giveaways and contests by rafflepressGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway PageCVE-2026-973175.3 Medium
- imagely nextgen galleryWordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerabilityCVE-2026-941237.5 High
- syed balkhi wpformsWPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationCVE-2026-847446.5 Medium
- syed balkhi wpformsWPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntentCVE-2026-749916.8 Medium
- easy digital downloads digital downloads, syed balkhi easy digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerabilityCVE-2026-955227.6 High
- syed balkhi charitableWordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerabilityCVE-2026-812878.5 High
- syed balkhi charitableCharitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature BypassCVE-2026-166505.3 Medium
- syed balkhi charitableWordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerabilityCVE-2026-739947.5 High
- imagely nextgen galleryWordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-281417.1 High
- syed balkhi charitableCharitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT TextCVE-2025-156754.8 Medium
- easy digital downloads digital downloads, syed balkhi easy digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerabilityCVE-2026-664764.9 Medium
- syed balkhi intranet & private site – all-in-one intranetWordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerabilityCVE-2026-548377.5 High
- syed balkhi pushengage – web push notifications, ecommerce automation & chat widgetWordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerabilityCVE-2026-526987.4 High
- awesomemotive contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerabilityCVE-2026-488357.5 High
- syed balkhi wpformsWPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook ForgeryCVE-2026-49865.3 Medium
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-407648.1 High
- syed balkhi user feedbackWordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerabilityCVE-2026-394764.3 Medium
- syed balkhi user feedbackWordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerabilityCVE-2026-394757.6 High
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerabilityCVE-2026-253396.5 Medium
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerabilityCVE-2026-324464.3 Medium
- syed balkhi sugar calendar (lite)WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerabilityCVE-2026-246364.3 Medium
- syed balkhi wpformsWPForms 1.7.8 - Cross-Site Scripting (XSS)CVE-2020-369195.1 Medium
- syed balkhi user feedbackWordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerabilityCVE-2025-684967.6 High
- syed balkhi all in one seo packWordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerabilityCVE-2025-642956.5 Medium
- syed balkhi all in one seo packWordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerabilityCVE-2025-679508.5 High
- syed balkhi feeds for youtubeWordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerabilityCVE-2025-646355.3 Medium
- syed balkhi giveaways and contests by rafflepressWordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2025-660644.3 Medium
- syed balkhi smash balloon social post feedWordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerabilityCVE-2025-499374.3 Medium
- smub athemes addons for elementorWordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-601126.5 Medium
- syed balkhi affiliatewp – external referral linksWordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-534605.9 Medium
- noumaan yaqoob compact archivesWordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-580016.5 Medium
- syed balkhi all in one seo packWordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure VulnerabilityCVE-2025-586494.3 Medium
- syed balkhi all in one seo packWordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control VulnerabilityCVE-2025-586505.4 Medium
- syed balkhi giveaways and contests by rafflepressWordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF VulnerabilityCVE-2025-499975.3 Medium
- seedprod rafflepress, syed balkhi giveaways and contests by rafflepress +1 moreGiveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSSCVE-2024-101074.8 Medium
- syed balkhi beacon lead magnets and lead captureWordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2025-475964.3 Medium
- syed balkhi charitableWordPress Charitable plugin <= 1.8.5.1 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-475205.9 Medium
- syed balkhi floating social barWordPress Floating Social Bar plugin <= 1.1.7 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-464515.9 Medium
- syed balkhi beacon lead magnets and lead captureWordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2025-246377.1 High
- athemes addons for elementor, smub athemes addons for elementor +1 moreWordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerabilityCVE-2025-321587.5 High
- syed balkhi simple post expirationWordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-317346.5 Medium
- athemes addons for elementor, smub athemes addons for elementor +1 moreWordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerabilityCVE-2025-226466.5 Medium
- syed balkhi charitableWordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-307706.5 Medium
- syed balkhi exactmetricsWordPress ExactMetrics plugin <= 8.1.0 - Broken Access Control vulnerabilityCVE-2025-247505.4 Medium
- syed balkhi contact form by wpforms, wpforms +1 moreWordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerabilityCVE-2024-562764.3 Medium
- syed balkhi wpformsWPForms < 1.9.2.3 - Admin+ Stored XSSCVE-2024-112234.7 Medium
- Show olderLoading…