# cve.now: Saad Iqbal

The newest entries naming Saad Iqbal as an affected vendor (up to 200), of 50 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-94175](https://cve.now/CVE-2026-94175.md): WordPress All In One Login plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-39734](https://cve.now/CVE-2026-39734.md): WordPress WP EasyPay plugin \<= 4.5.4 - Path Traversal vulnerability (CVSS 7.5)
- [CVE-2026-84762](https://cve.now/CVE-2026-84762.md): WordPress WP EasyPay plugin \<= 4.5.3 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2026-73345](https://cve.now/CVE-2026-73345.md): WordPress License Manager for WooCommerce plugin \<= 3.0.18 - SQL Injection vulnerability (CVSS 7.1)
- [CVE-2026-66425](https://cve.now/CVE-2026-66425.md): WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin \<= 1.9.0 - Broken Authentication vulnerability (CVSS 6.5)
- [CVE-2026-57808](https://cve.now/CVE-2026-57808.md): WordPress WP EasyPay plugin \<= 4.5.0 - Arbitrary Content Deletion vulnerability (CVSS 6.5)
- [CVE-2026-61968](https://cve.now/CVE-2026-61968.md): WordPress myCred plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-61958](https://cve.now/CVE-2026-61958.md): WordPress License Manager for WooCommerce plugin \<= 3.0.17 - Arbitrary Content Deletion vulnerability (CVSS 5.4)
- [CVE-2026-57810](https://cve.now/CVE-2026-57810.md): WordPress APIExperts Square for WooCommerce plugin \<= 4.7.4 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-54848](https://cve.now/CVE-2026-54848.md): WordPress APIExperts Square for WooCommerce plugin \<= 4.7.3 - Sensitive Data Exposure vulnerability (CVSS 8.3)
- [CVE-2026-56024](https://cve.now/CVE-2026-56024.md): WordPress WP EasyPay plugin \<= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5)
- [CVE-2026-45215](https://cve.now/CVE-2026-45215.md): WordPress WP EasyPay plugin \<= 4.3.0 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-45211](https://cve.now/CVE-2026-45211.md): WordPress APIExperts Square for WooCommerce plugin \<= 4.7.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-25390](https://cve.now/CVE-2026-25390.md): WordPress New User Approve plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-25001](https://cve.now/CVE-2026-25001.md): WordPress Post Snippets plugin \<= 4.0.12 - Remote Code Execution (RCE) vulnerability (CVSS 8.5)
- [CVE-2026-32587](https://cve.now/CVE-2026-32587.md): WordPress WP EasyPay plugin \<= 4.2.11 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-69063](https://cve.now/CVE-2025-69063.md): WordPress New User Approve plugin \<= 3.2.0 - Broken Access Control vulnerability (CVSS 8.6)
- [CVE-2026-27440](https://cve.now/CVE-2026-27440.md): WordPress myCred plugin \<= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-24951](https://cve.now/CVE-2026-24951.md): WordPress myCred plugin \<= 2.9.7.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-68881](https://cve.now/CVE-2025-68881.md): WordPress AppExperts plugin \<= 1.4.5 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-63040](https://cve.now/CVE-2025-63040.md): WordPress Post Snippets plugin \<= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-68080](https://cve.now/CVE-2025-68080.md): WordPress User Avatar - Reloaded plugin \<= 1.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-63030](https://cve.now/CVE-2025-63030.md): WordPress New User Approve plugin \<= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1)
- [CVE-2025-67563](https://cve.now/CVE-2025-67563.md): WordPress Post SMTP plugin \<= 3.6.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-67471](https://cve.now/CVE-2025-67471.md): WordPress Quick Contact Form plugin \<= 8.2.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-58595](https://cve.now/CVE-2025-58595.md): WordPress All In One Login plugin \<= 2.0.8 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2025-53218](https://cve.now/CVE-2025-53218.md): WordPress AppExperts plugin \<= 1.4.5 - Sensitive Data Exposure vulnerability (CVSS 5.8)
- [CVE-2025-58788](https://cve.now/CVE-2025-58788.md): WordPress License Manager for WooCommerce Plugin \<= 3.0.12 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-48142](https://cve.now/CVE-2025-48142.md): WordPress Bookify \<= 1.0.9 - Privilege Escalation Vulnerability (CVSS 8.8)
- [CVE-2025-54668](https://cve.now/CVE-2025-54668.md): WordPress myCred plugin \<= 2.9.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-54667](https://cve.now/CVE-2025-54667.md): WordPress myCred plugin \<= 2.9.4.3 - Race Condition Vulnerability (CVSS 5.3)
- [CVE-2025-24000](https://cve.now/CVE-2025-24000.md): WordPress Post SMTP plugin \<= 3.2.0 - Account Takeover Vulnerability (CVSS 8.8)
- [CVE-2025-49857](https://cve.now/CVE-2025-49857.md): WordPress myCred plugin \<= 2.9.4.2 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-49872](https://cve.now/CVE-2025-49872.md): WordPress myCred plugin \<= 2.9.4.2 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-48245](https://cve.now/CVE-2025-48245.md): WordPress Quick Contact Form plugin \<= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-47688](https://cve.now/CVE-2025-47688.md): WordPress Advanced File Manager plugin \<= 5.3.1 - Broken Access Control to Notice Dismissal vulnerability (CVSS 5.3)
- [CVE-2025-32522](https://cve.now/CVE-2025-32522.md): WordPress License Manager for WooCommerce plugin \<= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-31805](https://cve.now/CVE-2025-31805.md): WordPress Gutena Kit plugin \<= 2.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-30609](https://cve.now/CVE-2025-30609.md): WordPress AppExperts plugin \<= 1.4.3 - Sensitive Data Exposure Vulnerability (CVSS 5.3)
- [CVE-2025-22736](https://cve.now/CVE-2025-22736.md): WordPress User Management plugin \<= 1.2 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-22800](https://cve.now/CVE-2025-22800.md): WordPress Post SMTP plugin \<= 2.9.11 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-54323](https://cve.now/CVE-2024-54323.md): WordPress New User Approve plugin \<= 2.6.2 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-52436](https://cve.now/CVE-2024-52436.md): WordPress Post SMTP plugin \<= 2.9.9 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-52403](https://cve.now/CVE-2024-52403.md): WordPress User Management plugin \<= 1.1 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2024-49702](https://cve.now/CVE-2024-49702.md): WordPress myCred Elementor plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-47338](https://cve.now/CVE-2024-47338.md): WordPress WPExperts Square For GiveWP plugin \<= 1.3 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-43214](https://cve.now/CVE-2024-43214.md): WordPress myCred plugin \<= 2.7.2 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2024-43354](https://cve.now/CVE-2024-43354.md): WordPress myCred plugin \<= 2.7.2 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2024-43353](https://cve.now/CVE-2024-43353.md): WordPress myCred plugin \<= 2.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-32711](https://cve.now/CVE-2024-32711.md): WordPress myCred plugin \<= 2.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/saad-iqbal
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.