Log in Start free

Syed Balkhi

Products

ProductCVEsExploitedLatest
Charitable5–Oct 6, 2026
aThemes Addons for Elementor4–Sep 26, 2025
All In One SEO Pack4–Dec 18, 2025
Contact Form by WPForms4–Apr 15, 2026
User Feedback4–Apr 8, 2026
Easy Digital Downloads3–Sep 23, 2026
Giveaways and Contests by RafflePress2–Nov 21, 2025
Beacon Lead Magnets and Lead Capture2–May 7, 2025
NextGEN Gallery2–Sep 30, 2026
Simple Post Expiration1–Apr 1, 2025
Smash Balloon Social Post Feed1–Oct 22, 2025
Sugar Calendar (Lite)1–Jan 23, 2026
Table of Contents Plus1–Oct 20, 2024
WP Lightbox 21–Oct 24, 2023
AffiliateWP – External Referral Links1–Sep 22, 2025
WPForms1–Jan 13, 2026
Compact Archives1–Sep 22, 2025
Custom Twitter Feeds (Tweets Widget)1–Oct 31, 2024
Envira Gallery1–Oct 9, 2026
ExactMetrics1–Jan 24, 2025
Feeds for YouTube1–Dec 16, 2025
Floating Social Bar1–Apr 24, 2025
Intranet & Private Site – All-In-One Intranet1–Jun 26, 2026
PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget1–Jun 17, 2026

Exploited and recent CVEs

  • CVE-2026-104079 Medium 4.3 Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint 0.2%
  • CVE-2026-104394 High 7.1 WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-94123 High 7.5 WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability 0.4%
  • CVE-2026-95522 High 7.6 WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability 0.4%
  • CVE-2026-81287 High 8.5 WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability 0.4%
  • CVE-2026-73994 High 7.5 WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability 0.3%
  • CVE-2026-28141 High 7.1 WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability 0.5%
  • CVE-2026-66476 Medium 4.9 WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability 0.5%
  • CVE-2026-54837 High 7.5 WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability 0.4%
  • CVE-2026-52698 High 7.4 WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2026-40764 High 8.1 WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-39476 Medium 4.3 WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability 0.2%
  • CVE-2026-39475 High 7.6 WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability 0.3%
  • CVE-2026-25339 Medium 6.5 WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2026-32446 Medium 4.3 WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability 0.2%
  • CVE-2026-24636 Medium 4.3 WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability 0.2%
  • CVE-2020-36919 Medium 6.1 WPForms 1.7.8 - Cross-Site Scripting (XSS) 0.4%
  • CVE-2025-68496 High 7.6 WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability 0.5%
  • CVE-2025-64295 Medium 6.5 WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2025-67950 High 8.5 WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability 0.3%
  • CVE-2025-64635 Medium 5.3 WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability 0.3%
  • CVE-2025-66064 Medium 4.3 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2025-49937 Medium 4.3 WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerability 0.2%
  • CVE-2025-60112 Medium 6.5 WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability 0.2%
  • CVE-2025-53460 Medium 5.9 WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability 0.3%
  • CVE-2025-58001 Medium 6.5 WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-58649 Medium 4.3 WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure Vulnerability 0.3%
  • CVE-2025-58650 Medium 5.4 WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control Vulnerability 0.3%
  • CVE-2025-49997 Medium 5.3 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability 0.3%
  • CVE-2025-47596 Medium 4.3 WordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability 0.2%