Syed Balkhi vulnerabilities
45 vulnerabilities
Known vulnerabilities in Syed Balkhi products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 24 products.
Products
24- Charitable5 vulnerabilities
- All In One SEO Pack4 vulnerabilities
- Athemes Addons For Elementor4 vulnerabilities
- Contact Form By Wpforms4 vulnerabilities
- User Feedback4 vulnerabilities
- Easy Digital Downloads3 vulnerabilities
- Beacon Lead Magnets And Lead Capture2 vulnerabilities
- Giveaways And Contests By Rafflepress2 vulnerabilities
- Nextgen Gallery2 vulnerabilities
- Affiliatewp – External Referral Links1 vulnerabilities
- Compact Archives1 vulnerabilities
- Custom Twitter Feeds (Tweets Widget)1 vulnerabilities
- Envira Gallery1 vulnerabilities
- Exactmetrics1 vulnerabilities
- Feeds For Youtube1 vulnerabilities
- Floating Social Bar1 vulnerabilities
- Intranet &Amp; Private Site – All In One Intranet1 vulnerabilities
- Pushengage – Web Push Notifications, Ecommerce Automation &Amp; Chat Widget1 vulnerabilities
- Simple Post Expiration1 vulnerabilities
- Smash Balloon Social Post Feed1 vulnerabilities
- Sugar Calendar (Lite)1 vulnerabilities
- Table Of Contents Plus1 vulnerabilities
- WP Lightbox 21 vulnerabilities
- Wpforms1 vulnerabilities
HighCVE-2025-68496syed balkhi · user feedback +1 moreWordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.EPSS0.47%MediumCVE-2025-47596syed balkhi · beacon lead magnets and lead capture +1 moreWordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Cross Site Request Forgery.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.8.EPSS0.17%MediumCVE-2025-47520syed balkhi · charitable +1 moreWordPress Charitable plugin <= 1.8.5.1 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows Stored XSS.This issue affects Charitable: from n/a through <= 1.8.5.1.EPSS0.27%MediumCVE-2025-31734syed balkhi · simple post expiration +1 moreWordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Simple Post Expiration simple-post-expiration allows DOM-Based XSS.This issue affects Simple Post Expiration: from n/a through <= 1.0.1.EPSS0.36%MediumCVE-2025-53460syed balkhi · affiliatewp – external referral links +1 moreWordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through <= 1.2.0.EPSS0.30%MediumCVE-2025-66064syed balkhi · giveaways and contests by rafflepress +1 moreWordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.20.EPSS0.14%MediumCVE-2025-58650syed balkhi · all in one seo pack +1 moreWordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control VulnerabilityMissing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.EPSS0.27%MediumCVE-2025-58649syed balkhi · all in one seo pack +1 moreWordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure VulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.EPSS0.28%MediumCVE-2025-58001syed balkhi · compact archives +1 moreWordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.EPSS0.21%HighCVE-2025-67950syed balkhi · all in one seo pack +1 moreWordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n/a through <= 4.9.1.EPSS0.30%MediumCVE-2025-46451syed balkhi · floating social bar +1 moreWordPress Floating Social Bar plugin <= 1.1.7 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allows Stored XSS.This issue affects Floating Social Bar: from n/a through <= 1.1.7.EPSS0.27%MediumCVE-2025-22646athemes · athemes_addons_for_elementor +2 moreWordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.8.EPSS0.26%MediumCVE-2025-24750syed balkhi · exactmetrics +1 moreWordPress ExactMetrics plugin <= 8.1.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Syed Balkhi ExactMetrics google-analytics-dashboard-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ExactMetrics: from n/a through <= 8.1.0.EPSS0.31%HighCVE-2025-24637syed balkhi · beacon lead magnets and lead capture +1 moreWordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.7.EPSS0.29%MediumCVE-2025-64295syed balkhi · all in one seo pack +1 moreWordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.EPSS0.32%MediumCVE-2025-64635syed balkhi · feeds for youtube +1 moreWordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0.EPSS0.25%MediumCVE-2025-49937syed balkhi · smash balloon social post feed +1 moreWordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.EPSS0.24%MediumCVE-2025-49997syed balkhi · giveaways and contests by rafflepress +1 moreWordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF VulnerabilityMissing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.EPSS0.31%HighCVE-2025-32158athemes · athemes_addons_for_elementor +2 moreWordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.3.EPSS0.74%MediumCVE-2025-30770syed balkhi · charitable +1 moreWordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.This issue affects Charitable: from n/a through <= 1.8.4.7.EPSS0.36%