Syed Balkhi vulnerabilities, page 2

45 vulnerabilities

Known vulnerabilities in Syed Balkhi products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 24 products.

6.5MediumCVE-2025-60112syed balkhi · athemes addons for elementor +1 moreWordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.EPSS0.21%6.1MediumCVE-2020-36919syed balkhi · wpforms +1 moreWPForms 1.7.8 - Cross-Site Scripting (XSS)WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.EPSS0.38%6.5MediumCVE-2024-51675athemes · athemes_addons_for_elementor +2 moreWordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows DOM-Based XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.7.EPSS0.26%8.8HighCVE-2024-56276syed balkhi · contact form by wpforms +2 moreWordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.EPSS0.40%8.8HighCVE-2024-49250dublue · table_of_contents_plus +2 moreWordPress Table of Contents Plus plugin <= 2408 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through <= 2408.EPSS0.21%8.8HighCVE-2024-49685smashballoon · custom_twitter_feeds +2 moreWordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a through <= 2.2.3.EPSS0.20%7.5HighCVE-2026-54837syed balkhi · intranet &amp; private site &#8211; all-in-one intranet +1 moreWordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.EPSS0.39%7.5HighCVE-2026-73994syed balkhi · charitable +1 moreWordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.EPSS0.35%8.1HighCVE-2026-40764syed balkhi · contact form by wpforms +1 moreWordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.EPSS0.14%7.4HighCVE-2026-52698syed balkhi · pushengage – web push notifications, ecommerce automation &amp; chat widget +1 moreWordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerabilitySubscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2.3 versions.EPSS0.28%4.3MediumCVE-2026-39476syed balkhi · user feedback +1 moreWordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.EPSS0.27%7.6HighCVE-2026-39475syed balkhi · user feedback +1 moreWordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.EPSS0.36%6.5MediumCVE-2026-25339syed balkhi · contact form by wpforms +1 moreWordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.EPSS0.24%6.5MediumCVE-2026-66476syed balkhi · easy digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerabilityAdministrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.EPSS0.50%7.5HighCVE-2026-94123syed balkhi · nextgen gallery +1 moreWordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerabilityUnauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.EPSS0.40%7.2HighCVE-2026-104394syed balkhi · charitable +1 moreWordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.EPSS0.24%5.3MediumCVE-2026-104079syed balkhi · envira gallery +1 moreEnvira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST EndpointEnvira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.EPSS0.19%4.3MediumCVE-2026-24636syed balkhi · sugar calendar (lite) +1 moreWordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.EPSS0.22%7.6HighCVE-2026-95522syed balkhi · easy digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerabilityShop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.EPSS0.29%7.2HighCVE-2026-28141syed balkhi · nextgen gallery +1 moreWordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.EPSS0.47%