Syed Balkhi
39 CVEs across 23 Syed Balkhi products. Browse Syed Balkhi vulnerabilities, severities, and proof-of-concept exploits.
Syed Balkhi products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28141 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. |
CVE-2026-66476 | Medium | 4.9 | 2026-07-27 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. |
CVE-2026-54837 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions. |
CVE-2026-52698 | High | 7.4 | 2026-06-17 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. |
CVE-2026-40764 | High | 8.1 | 2026-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contac… |
CVE-2026-39476 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-39475 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind… |
CVE-2026-25339 | Medium | 6.5 | 2026-03-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2026-32446 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-24636 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2020-36919 | Medium | 6.1 | 2026-01-13 | WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts throu… |
CVE-2025-68496 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind… |
CVE-2025-64295 | Medium | 6.5 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data… |
CVE-2025-67950 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allow… |
CVE-2025-64635 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66064 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue a… |
CVE-2025-49937 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-60112 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-f… |
CVE-2025-58650 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58649 | Medium | 4.3 | 2025-09-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data… |
CVE-2025-58001 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stor… |
CVE-2025-53460 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi AffiliateWP – External Referral Links affilia… |
CVE-2025-49997 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by… |
CVE-2025-47596 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Cross Site Request Forgery.This issue affe… |
CVE-2025-47520 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows Stored XSS.This… |
CVE-2025-46451 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allow… |
CVE-2025-24637 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-b… |
CVE-2025-32158 | High | 7.5 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Element… |
CVE-2025-31734 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Simple Post Expiration simple-post-expiration… |
CVE-2025-22646 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-f… |
CVE-2025-30770 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.Th… |
CVE-2025-24750 | Medium | 5.4 | 2025-01-24 | Missing Authorization vulnerability in Syed Balkhi ExactMetrics google-analytics-dashboard-for-wp allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2024-56276 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2023-40005 | Medium | 5.3 | 2024-12-13 | Missing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2023-50887 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2024-51675 | Medium | 6.5 | 2024-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-f… |
CVE-2024-49685 | Medium | 5.4 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This… |
CVE-2024-49250 | Medium | 4.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affec… |
CVE-2023-45747 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions. |