CVE Intelligence

Vulnerabilidades de Syed Balkhi

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Syed Balkhi: 20 registro(s), com severidade, exploração e correções.

All In One SEO Pack 4Contact Form by WPForms 3User Feedback 3Giveaways and Contests by RafflePress 1Feeds for YouTube 1PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget 1Sugar Calendar (Lite) 1Intranet & Private Site – All-In-One Intranet 1Envira Gallery 1Charitable 1aThemes Addons for Elementor 1Smash Balloon Social Post Feed 1WPForms 1

Somente exploradas (KEV) →

CVE-2026-104079 Média · 4.3 CWE-862 09/10/2026
Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.
CVE-2026-104394 Alta · 7.1 CWE-79 06/10/2026
WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
CVE-2026-54837 Alta · 7.5 CWE-862 26/06/2026
WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.
CVE-2026-52698 Alta · 7.4 CWE-201 17/06/2026
WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2.3 versions.
CVE-2026-40764 Alta · 8.1 CWE-352 15/04/2026
WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.
CVE-2026-39476 Média · 4.3 CWE-862 08/04/2026
WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.
CVE-2026-39475 Alta · 7.6 CWE-89 08/04/2026
WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.
CVE-2026-25339 Média · 6.5 CWE-201 25/03/2026
WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.
CVE-2026-32446 Média · 4.3 CWE-862 13/03/2026
WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.
CVE-2026-24636 Média · 4.3 CWE-862 23/01/2026
WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.
CVE-2020-36919 Média · 6.1 CWE-79 13/01/2026
WPForms 1.7.8 - Cross-Site Scripting (XSS)
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.
CVE-2025-68496 Alta · 7.6 CWE-89 24/12/2025
WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.
CVE-2025-64295 Média · 6.5 CWE-201 18/12/2025
WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.
CVE-2025-67950 Alta · 8.5 CWE-89 16/12/2025
WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n/a through <= 4.9.1.
CVE-2025-64635 Média · 5.3 CWE-862 16/12/2025
WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0.
CVE-2025-66064 Média · 4.3 CWE-352 21/11/2025
WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.20.
CVE-2025-49937 Média · 4.3 CWE-862 22/10/2025
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook...
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.
CVE-2025-60112 Média · 6.5 CWE-79 26/09/2025
WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.
CVE-2025-58650 Média · 5.4 CWE-862 22/09/2025
WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.
CVE-2025-58649 Média · 4.3 CWE-201 22/09/2025
WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure Vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.