CveMateVulnerability intelligence

Saadiqbal vulnerabilities

40 vulnerabilities

Known vulnerabilities in Saadiqbal products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 22 products.

Products

22

Points Management System For Gamification, Ranks, Badges, And Loyalty Rewards Program – Mycred9 vulnerabilities
Advanced File Manager – Ultimate File Manager For Wordpress And Document Library Solution8 vulnerabilities
WP Easy Pay – Payment And Donation Form Builder For Square5 vulnerabilities
Password Protected — Lock Entire Site, Pages, Posts, Categories, And Partial Content4 vulnerabilities
New User Approve3 vulnerabilities
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, And Custom Form Builder2 vulnerabilities
License Manager For Woocommerce2 vulnerabilities
Post Snippets – Custom Wordpress Code Snippets Customizer2 vulnerabilities
Quick Contact Form2 vulnerabilities
Wholesale For Woocommerce2 vulnerabilities
Advanced File Manager — Ultimate Wordpress File Manager And Document Library Plugin1 vulnerabilities
Appexperts – Mobile App Builder For Wordpress | Woocommerce To Ios And Android Apps1 vulnerabilities
B2B Request A Quote1 vulnerabilities
Email Templates Customizer And Designer For Wordpress And Woocommerce1 vulnerabilities
Post SMTP – Complete Email Deliverability And SMTP Solution With Email Logs, Alerts, Backup SMTP & Mobile App1 vulnerabilities
Post SMTP – Complete Email Delivery And SMTP Solution With Email Logs, Alerts, Backup SMTP & Mobile App1 vulnerabilities
Rocket Maintenance Mode & Coming Soon Page1 vulnerabilities
User Management1 vulnerabilities
WC Shop Sync – Square Payment Gateway And Product Synchronization For Woocommerce1 vulnerabilities
WP Contact Slider – Contact Form Slider Widget1 vulnerabilities
Wpexperts Square For Givewp1 vulnerabilities
Wpformify – Stripe Payments With Form And Checkout1 vulnerabilities

CVE-2021-4411saadiqbalwp easy pay – payment and donation form builder for square+23y ago12-07-2023 03:40

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpep_download_transaction_in_excel() function. This makes it possible for unauthenticated attackers to trigger a transactions download via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2021-4422saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+23y ago12-07-2023 06:52

The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-11244saadiqbalpassword protected — lock entire site, pages, posts, categories, and partial content+112mo ago25-10-2025 05:31

The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the "Use transients" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the "Use transients" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers.CVE-2025-0818file managerfile manager pro+51y ago13-08-2025 03:42

Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.CVE-2025-12718saadiqbalquick contact form+19mo ago17-01-2026 02:22

The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.CVE-2025-12361saadiqbalpoints management system for gamification, ranks, badges, and loyalty rewards program – mycred+110mo ago19-12-2025 09:29

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.CVE-2025-12362saadiqbalpoints management system for gamification, ranks, badges, and loyalty rewards program – mycred+110mo ago13-12-2025 05:42

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.CVE-2025-12770saadiqbalnew user approve+111mo ago19-11-2025 03:29

The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key validation using loose equality comparison. This makes it possible for unauthenticated attackers to retrieve personally identifiable information (PII), including usernames and email addresses of users with various approval statuses via the Zapier REST API endpoints, by exploiting PHP type juggling with the api_key parameter set to "0" on sites where the Zapier API key has not been configured.CVE-2025-3453saadiqbalpassword protected — lock entire site, pages, posts, categories, and partial content+11y ago17-04-2025 11:13

The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.CVE-2022-49745starpluginseasy_age_verify+12392y ago16-10-2024 06:43

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.CVE-2024-13713saadiqbalwpexperts square for givewp+21y ago21-02-2025 11:09

The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2024-13333advancedfilemanageradvanced_file_manager+21y ago17-01-2025 05:29

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled.CVE-2024-13805advancedfilemanageradvanced_file_manager+21y ago07-03-2025 09:21

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.CVE-2024-1639saadiqballicense manager for woocommerce+22y ago21-06-2024 02:05

The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Please note that the version in trunk is patched, however, the 3.0.7 tagged version is not.CVE-2024-11391advancedfilemanageradvanced_file_manager+21y ago03-12-2024 14:34

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.CVE-2024-11201saadiqbalpoints management system for gamification, ranks, badges, and loyalty rewards program – mycred+11y ago06-12-2024 05:26

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_send shortcode in all versions up to, and including, 2.7.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-0437saadiqbalpassword protected — lock entire site, pages, posts, categories, and partial content+12y ago14-05-2024 23:31

The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the API. This makes it possible for authenticated attackers, with subscriber access or higher, to extract post titles and content, thus bypassing the plugin's password protection.CVE-2024-0656saadiqbalpassword protected — lock entire site, pages, posts, categories, and partial content+22y ago20-02-2024 18:56

The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Captcha Site Key in all versions up to, and including, 2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.CVE-2024-5598advancedfilemanageradvanced_file_manager+22y ago29-06-2024 04:33

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.CVE-2024-5861saadiqbalwp easy pay – payment and donation form builder for square+22y ago24-07-2024 03:17

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.