SB
Vendor
Syed Balkhi
38
CVEs
0
On KEV
3
New 30D
Products
CH8.5
Charitable
Syed Balkhi
5 CVEs0 on KEV1 new
NG7.5
NextGEN Gallery
Syed Balkhi
2 CVEs0 on KEV1 new
EG4.3
Envira Gallery
Syed Balkhi
1 CVEs0 on KEV1 new
AI8.5
All In One SEO Pack
Syed Balkhi
4 CVEs0 on KEV0 new
CF8.8
Contact Form by WPForms
Syed Balkhi
4 CVEs0 on KEV0 new
AA8.8
aThemes Addons for Elementor
Syed Balkhi
3 CVEs0 on KEV0 new
UF7.6
User Feedback
Syed Balkhi
3 CVEs0 on KEV0 new
BL7.1
Beacon Lead Magnets and Lead Capture
Syed Balkhi
2 CVEs0 on KEV0 new
ED7.6
Easy Digital Downloads
Syed Balkhi
2 CVEs0 on KEV0 new
GA5.3
Giveaways and Contests by RafflePress
Syed Balkhi
2 CVEs0 on KEV0 new
AE5.9
AffiliateWP – External Referral Links
Syed Balkhi
1 CVEs0 on KEV0 new
CA6.5
Compact Archives
Syed Balkhi
1 CVEs0 on KEV0 new
FF5.3
Feeds for YouTube
Syed Balkhi
1 CVEs0 on KEV0 new
FS5.9
Floating Social Bar
Syed Balkhi
1 CVEs0 on KEV0 new
IA7.5
Intranet & Private Site – All-In-One Intranet
Syed Balkhi
1 CVEs0 on KEV0 new
PW7.4
PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget
Syed Balkhi
1 CVEs0 on KEV0 new
SP6.5
Simple Post Expiration
Syed Balkhi
1 CVEs0 on KEV0 new
SB4.3
Smash Balloon Social Post Feed
Syed Balkhi
1 CVEs0 on KEV0 new
SC4.3
Sugar Calendar (Lite)
Syed Balkhi
1 CVEs0 on KEV0 new
WP6.1
WPForms
Syed Balkhi
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104079 | EG Envira Gallery Syed Balkhi | 4.3 | Oct 9 | Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint |
| CVE-2026-104394 | CH Charitable Syed Balkhi | 7.1 | Oct 6 | WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-94123 | NG NextGEN Gallery Syed Balkhi | 7.5 | Sep 30 | WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability |
| CVE-2026-95522 | ED Easy Digital Downloads Syed Balkhi | 7.6 | Sep 23 | WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability |
| CVE-2026-81287 | CH Charitable Syed Balkhi | 8.5 | Aug 31 | WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability |
| CVE-2026-73994 | CH Charitable Syed Balkhi | 7.5 | Aug 18 | WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability |
| CVE-2026-28141 | NG NextGEN Gallery Syed Balkhi | 7.1 | Aug 6 | WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-66476 | ED Easy Digital Downloads Syed Balkhi | 4.9 | Jul 27 | WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability |
| CVE-2026-54837 | IA Intranet & Private Site – All-In-One Intranet Syed Balkhi | 7.5 | Jun 26 | WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2026-52698 | PW PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget Syed Balkhi | 7.4 | Jun 17 | WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability |
| CVE-2026-40764 | CF Contact Form by WPForms Syed Balkhi | 8.1 | Apr 15 | WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-39476 | UF User Feedback Syed Balkhi | 4.3 | Apr 8 | WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability |
| CVE-2026-39475 | UF User Feedback Syed Balkhi | 7.6 | Apr 8 | WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability |
| CVE-2026-25339 | CF Contact Form by WPForms Syed Balkhi | 6.5 | Mar 25 | WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability |
| CVE-2026-32446 | CF Contact Form by WPForms Syed Balkhi | 4.3 | Mar 13 | WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability |
| CVE-2026-24636 | SC Sugar Calendar (Lite) Syed Balkhi | 4.3 | Jan 23 | WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability |
| CVE-2020-36919 | WP WPForms Syed Balkhi | 6.1 | Jan 13 | WPForms 1.7.8 - Cross-Site Scripting (XSS) |
| CVE-2025-68496 | UF User Feedback Syed Balkhi | 7.6 | Dec 24 | WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability |
| CVE-2025-64295 | AI All In One SEO Pack Syed Balkhi | 6.5 | Dec 18 | WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability |
| CVE-2025-67950 | AI All In One SEO Pack Syed Balkhi | 8.5 | Dec 16 | WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability |
| CVE-2025-64635 | FF Feeds for YouTube Syed Balkhi | 5.3 | Dec 16 | WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2025-66064 | GA Giveaways and Contests by RafflePress Syed Balkhi | 4.3 | Nov 21 | WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2025-49937 | SB Smash Balloon Social Post Feed Syed Balkhi | 4.3 | Oct 22 | WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerability |
| CVE-2025-60112 | AA aThemes Addons for Elementor Syed Balkhi | 6.5 | Sep 26 | WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-53460 | AE AffiliateWP – External Referral Links Syed Balkhi | 5.9 | Sep 22 | WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-58001 | CA Compact Archives Syed Balkhi | 6.5 | Sep 22 | WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-58649 | AI All In One SEO Pack Syed Balkhi | 4.3 | Sep 22 | WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure Vulnerability |
| CVE-2025-58650 | AI All In One SEO Pack Syed Balkhi | 5.4 | Sep 22 | WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control Vulnerability |
| CVE-2025-49997 | GA Giveaways and Contests by RafflePress Syed Balkhi | 5.3 | Jun 20 | WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability |
| CVE-2025-47596 | BL Beacon Lead Magnets and Lead Capture Syed Balkhi | 4.3 | May 7 | WordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2025-47520 | CH Charitable Syed Balkhi | 5.9 | May 7 | WordPress Charitable plugin <= 1.8.5.1 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-46451 | FS Floating Social Bar Syed Balkhi | 5.9 | Apr 24 | WordPress Floating Social Bar plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-24637 | BL Beacon Lead Magnets and Lead Capture Syed Balkhi | 7.1 | Apr 17 | WordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2025-32158 | AA aThemes Addons for Elementor Syed Balkhi | 8.8 | Apr 10 | WordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerability |
| CVE-2025-31734 | SP Simple Post Expiration Syed Balkhi | 6.5 | Apr 1 | WordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-22646 | AA aThemes Addons for Elementor Syed Balkhi | 5.4 | Mar 27 | WordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerability |
| CVE-2025-30770 | CH Charitable Syed Balkhi | 6.5 | Mar 27 | WordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-24750 | EX ExactMetrics Syed Balkhi | 5.4 | Jan 24 | WordPress ExactMetrics plugin <= 8.1.0 - Broken Access Control vulnerability |
| CVE-2024-56276 | CF Contact Form by WPForms Syed Balkhi | 8.8 | Jan 7 | WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability |