Fahadmahmood
13 CVEs across 13 Fahadmahmood products. Browse Fahadmahmood vulnerabilities, severities, and proof-of-concept exploits.
Fahadmahmood products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6802 | Medium | 5.3 | 2026-07-10 | The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1. This is due to mis… |
CVE-2026-3878 | Medium | 6.4 | 2026-04-16 | The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdocs_options[icon_size]' parameter in all versions up to, and includin… |
CVE-2026-3577 | Medium | 4.4 | 2026-03-21 | The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val` parameter) in the `update_kbd_bkup_al… |
CVE-2026-3368 | High | 7.2 | 2026-03-21 | The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1… |
CVE-2026-3339 | Low | 2.7 | 2026-03-21 | The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJ… |
CVE-2025-12075 | Medium | 4.3 | 2026-02-18 | The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wos_troubleshoot… |
CVE-2025-12682 | Critical | 9.8 | 2025-11-04 | The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_… |
CVE-2025-8046 | Medium | 6.1 | 2025-08-14 | The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could… |
CVE-2025-7808 | Medium | 6.1 | 2025-08-14 | The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13387 | Medium | 6.4 | 2025-01-16 | The WP Responsive Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprtabs' shortcode in all versions up to, and includ… |
CVE-2024-12468 | Medium | 6.1 | 2024-12-24 | The WP Datepicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpdp_get_selected_datepicker' parameter in all versions up to… |
CVE-2024-12405 | Medium | 6.1 | 2024-12-24 | The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in all versions up to, and including, 1.2… |
CVE-2024-12635 | Medium | 6.5 | 2024-12-21 | The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insuff… |
CVE-2024-9835 | Medium | 4.8 | 2024-11-12 | The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could… |
CVE-2024-10057 | Medium | 6.4 | 2024-10-18 | The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and… |
CVE-2024-35695 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Stored XSS.This issue… |
CVE-2024-3895 | High | 8.8 | 2024-05-02 | The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax… |
CVE-2022-1820 | Medium | 6.1 | 2022-06-13 | The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to… |