Skip to content
OpenAdvisories

Vendor

Syed Balkhi

45 known vulnerabilities.

Products

Charitable 5 All In One SEO Pack 4 User Feedback 4 aThemes Addons for Elementor 4 Contact Form by WPForms 4 Easy Digital Downloads 3 NextGEN Gallery 2 Beacon Lead Magnets and Lead Capture 2 Giveaways and Contests by RafflePress 2 AffiliateWP – External Referral Links 1 Custom Twitter Feeds (Tweets Widget) 1 Smash Balloon Social Post Feed 1 Intranet & Private Site – All-In-One Intranet 1 Sugar Calendar (Lite) 1 WPForms 1 Envira Gallery 1 Simple Post Expiration 1 PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget 1 Table of Contents Plus 1 Floating Social Bar 1 WP Lightbox 2 1 ExactMetrics 1 Compact Archives 1 Feeds for YouTube 1
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.1
    CVE-2026-104394

    WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

    Syed Balkhi Charitable
  • High 7.5
    CVE-2026-94123

    WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

    Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

    Syed Balkhi NextGEN Gallery
  • High 7.6
    CVE-2026-95522

    WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability

    Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

    Syed Balkhi Easy Digital Downloads
  • High 8.5
    CVE-2026-81287

    WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

    Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

    Syed Balkhi Charitable
  • High 7.5
    CVE-2026-73994

    WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

    Syed Balkhi Charitable
  • High 7.1
    CVE-2026-28141 Scanner template

    WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

    Syed Balkhi NextGEN Gallery
  • High 7.5
    CVE-2026-54837

    WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.

    Syed Balkhi Intranet &amp; Private Site &#8211; All-In-One Intranet
  • High 7.4
    CVE-2026-52698

    WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2.3 versions.

    Syed Balkhi PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget
  • High 8.1
    CVE-2026-40764

    WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.

    Syed Balkhi Contact Form by WPForms
  • High 7.6
    CVE-2026-39475

    WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.

    Syed Balkhi User Feedback
  • High 7.6
    CVE-2025-68496

    WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.

    Syed Balkhi User Feedback
  • High 8.5
    CVE-2025-67950

    WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n/a through <= 4.9.1.

    Syed Balkhi All In One SEO Pack
  • High 7.1
    CVE-2025-24637

    WordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= …

    Syed Balkhi Beacon Lead Magnets and Lead Capture
  • High 7.5
    CVE-2025-32158

    WordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite.This issue affects aThemes Addons for Elementor: from n/a throu…

    Syed Balkhi aThemes Addons for Elementor