# cve.now: Fahad Mahmood

The newest entries naming Fahad Mahmood as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-81782](https://cve.now/CVE-2026-81782.md): WordPress WP Docs plugin \<= 2.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-75133](https://cve.now/CVE-2026-75133.md): Keep Backup Daily WordPress Plugin \< 2.1.4 Sensitive Information Exposure via kbd\_cron\_process (CVSS 8.7)
- [CVE-2026-28567](https://cve.now/CVE-2026-28567.md): WordPress WP Sort Order plugin \<= 1.3.5 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-57419](https://cve.now/CVE-2026-57419.md): WordPress Stock Locations for WooCommerce plugin \<= 3.1.8 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-25332](https://cve.now/CVE-2026-25332.md): WordPress Endless Posts Navigation plugin \<= 2.2.9 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-24990](https://cve.now/CVE-2026-24990.md): WordPress WP Docs plugin \<= 2.2.8 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-69349](https://cve.now/CVE-2025-69349.md): WordPress RSS Feed Widget plugin \<= 3.0.2 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-62078](https://cve.now/CVE-2025-62078.md): WordPress Easy Upload Files During Checkout plugin \<= 3.0.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-47463](https://cve.now/CVE-2025-47463.md): WordPress Stock Locations for WooCommerce plugin \<= 2.8.6 - Broken Access Control Vulnerability (CVSS 7.1)
- [CVE-2025-30999](https://cve.now/CVE-2025-30999.md): WordPress External Store for Shopify plugin \<= 1.5.9 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-31089](https://cve.now/CVE-2025-31089.md): WordPress Order Splitter for WooCommerce plugin \<= 5.3.0 - SQL Injection Vulnerability (CVSS 8.5)
- [CVE-2025-31417](https://cve.now/CVE-2025-31417.md): WordPress WP Docs plugin \< 2.2.7 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-26751](https://cve.now/CVE-2025-26751.md): WordPress Alphabetic Pagination Plugin \<= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-26779](https://cve.now/CVE-2025-26779.md): WordPress Keep Backup Daily plugin \<= 2.1.0 - Arbitrary File Download vulnerability (CVSS 4.9)
- [CVE-2024-56288](https://cve.now/CVE-2024-56288.md): WordPress WP Docs plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-56223](https://cve.now/CVE-2024-56223.md): WordPress Gulri Slider plugin \<= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-54344](https://cve.now/CVE-2024-54344.md): WordPress WP Quick Shop plugin \<= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2023-32574](https://cve.now/CVE-2023-32574.md): WordPress Injection Guard plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-30873](https://cve.now/CVE-2023-30873.md): WordPress WP Docs plugin \<= 1.9.8 - Broken Access Control (CVSS 5.4)
- [CVE-2024-47321](https://cve.now/CVE-2024-47321.md): WordPress WP Datepicker plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-49629](https://cve.now/CVE-2024-49629.md): WordPress Endless Posts Navigation plugin \<= 2.2.7 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2024-48024](https://cve.now/CVE-2024-48024.md): WordPress Keep Backup Daily plugin \<= 2.1.3 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2024-44042](https://cve.now/CVE-2024-44042.md): WordPress WP Datepicker plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-31294](https://cve.now/CVE-2024-31294.md): WordPress WP Sort Order plugin \<= 1.3.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-35695](https://cve.now/CVE-2024-35695.md): WordPress WP Docs plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-35696](https://cve.now/CVE-2024-35696.md): WordPress WP Docs plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-32690](https://cve.now/CVE-2024-32690.md): WordPress RSS Feed Widget plugin \<= 2.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2023-32106](https://cve.now/CVE-2023-32106.md): WordPress WP Docs Plugin \<= 1.9.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2022-44736](https://cve.now/CVE-2022-44736.md): WordPress Chameleon plugin \<= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/fahad-mahmood
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.