Log in Start free

saadiqbal

Products

ProductCVEsExploitedLatest
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App13–Mar 18, 2026
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution8–Aug 16, 2026
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred8–Sep 9, 2026
WP Easy Pay – Payment and Donation Form Builder for Square4–Sep 18, 2026
Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content4–Oct 25, 2025
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder2–Aug 1, 2026
New User Approve2–Jan 28, 2026
Post Snippets – Custom WordPress Code Snippets Customizer2–Oct 28, 2026
WPFormify – Stripe Payments with Form and Checkout1–Aug 5, 2026
Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin1–Jan 17, 2025
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App1–Oct 6, 2026
Email Templates Customizer and Designer for WordPress and WooCommerce1–Oct 30, 2026
Quick Contact Form1–Jan 17, 2026
User Management1–Jul 8, 2026
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce1–Oct 16, 2024
Wholesale for WooCommerce1–Jul 29, 2026
License Manager for WooCommerce1–Jun 21, 2024
WPExperts Square For GiveWP1–Feb 21, 2025
Password Protected – Protect Your Site Content With a Password1–Oct 29, 2026

Exploited and recent CVEs

  • CVE-2026-107630 High 7.5 Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter 0.5%
  • CVE-2026-93293 Medium 6.4 Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler 0.2%
  • CVE-2026-77871 Medium 6.4 Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.2%
  • CVE-2026-75962 High 7.2 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log) 0.3%
  • CVE-2026-12739 Medium 4.3 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion 0.5%
  • CVE-2026-17149 Medium 6.4 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute 0.4%
  • CVE-2026-15009 Medium 6.1 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter 0.4%
  • CVE-2026-6627 High 8.2 WPFormify <= 1.1.1 - Missing Authorization 0.7%
  • CVE-2026-11995 Medium 5.3 Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action() 0.6%
  • CVE-2026-12144 High 8.8 Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter 0.5%
  • CVE-2026-12738 Medium 4.3 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action 0.4%
  • CVE-2026-12097 Medium 5.3 User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification 0.4%
  • CVE-2026-8607 Medium 6.4 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute 0.3%
  • CVE-2026-7430 Medium 4.4 Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import 0.2%
  • CVE-2026-3090 High 7.2 Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' 0.2%
  • CVE-2026-2559 Medium 5.3 Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite 0.2%
  • CVE-2026-1674 Medium 6.5 Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema() 0.3%
  • CVE-2026-0550 Medium 6.4 myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode 0.2%
  • CVE-2026-0832 High 7.3 New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure 0.4%
  • CVE-2025-12718 Medium 5.8 Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay 0.2%
  • CVE-2025-12361 Medium 4.3 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure 0.2%
  • CVE-2025-12362 Medium 5.3 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval 0.3%
  • CVE-2025-12887 Medium 5.4 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update 0.3%
  • CVE-2025-12770 Medium 5.3 New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling 0.3%
  • CVE-2025-11833 Critical 9.8 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure 61.5%
  • CVE-2025-11244 Low 3.7 Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing 0.3%
  • CVE-2025-9219 Medium 4.3 Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update 0.3%
  • CVE-2025-0818 Medium 6.5 Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion 1.0%
  • CVE-2025-3453 Medium 5.3 Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposure 0.4%
  • CVE-2024-13844 Medium 4.9 Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter 0.4%