CVE Intelligence

Syed Balkhi vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Syed Balkhi products: 26 record(s), with severity, exploitation and fixes.

All In One SEO Pack 4Contact Form by WPForms 3User Feedback 3Charitable 3Easy Digital Downloads 2NextGEN Gallery 2Giveaways and Contests by RafflePress 1Feeds for YouTube 1PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget 1Sugar Calendar (Lite) 1Intranet & Private Site – All-In-One Intranet 1Envira Gallery 1aThemes Addons for Elementor 1Smash Balloon Social Post Feed 1WPForms 1

Exploited only (KEV) →

CVE-2026-104079 Medium · 4.3 CWE-862 Oct 9, 2026
Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.
CVE-2026-104394 High · 7.1 CWE-79 Oct 6, 2026
WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
CVE-2026-94123 High · 7.5 CWE-22 Sep 30, 2026
WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
CVE-2026-95522 High · 7.6 CWE-89 Sep 23, 2026
WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
CVE-2026-81287 High · 8.5 CWE-89 Aug 31, 2026
WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
CVE-2026-73994 High · 7.5 CWE-862 Aug 18, 2026
WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
CVE-2026-28141 High · 7.1 CWE-79 Aug 6, 2026
WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
CVE-2026-66476 Medium · 4.9 CWE-22 Jul 27, 2026
WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
CVE-2026-54837 High · 7.5 CWE-862 Jun 26, 2026
WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.
CVE-2026-52698 High · 7.4 CWE-201 Jun 17, 2026
WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2.3 versions.
CVE-2026-40764 High · 8.1 CWE-352 Apr 15, 2026
WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.
CVE-2026-39476 Medium · 4.3 CWE-862 Apr 8, 2026
WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.
CVE-2026-39475 High · 7.6 CWE-89 Apr 8, 2026
WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.
CVE-2026-25339 Medium · 6.5 CWE-201 Mar 25, 2026
WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.
CVE-2026-32446 Medium · 4.3 CWE-862 Mar 13, 2026
WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.
CVE-2026-24636 Medium · 4.3 CWE-862 Jan 23, 2026
WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.
CVE-2020-36919 Medium · 6.1 CWE-79 Jan 13, 2026
WPForms 1.7.8 - Cross-Site Scripting (XSS)
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.
CVE-2025-68496 High · 7.6 CWE-89 Dec 24, 2025
WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.
CVE-2025-64295 Medium · 6.5 CWE-201 Dec 18, 2025
WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.
CVE-2025-67950 High · 8.5 CWE-89 Dec 16, 2025
WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n/a through <= 4.9.1.
CVE-2025-64635 Medium · 5.3 CWE-862 Dec 16, 2025
WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0.
CVE-2025-66064 Medium · 4.3 CWE-352 Nov 21, 2025
WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.20.
CVE-2025-49937 Medium · 4.3 CWE-862 Oct 22, 2025
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook...
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.
CVE-2025-60112 Medium · 6.5 CWE-79 Sep 26, 2025
WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.
CVE-2025-58650 Medium · 5.4 CWE-862 Sep 22, 2025
WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.