# cve.now: Saadiqbal

The newest entries naming Saadiqbal as an affected vendor (up to 200), of 56 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107630](https://cve.now/CVE-2026-107630.md): Email Templates Customizer and Designer for WordPress and WooCommerce \<= 1.5.14 - Missing Authorization to Unauthenticated Order PII… (CVSS 7.5)
- [CVE-2026-93293](https://cve.now/CVE-2026-93293.md): Password Protected \<= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase\_completed Handler (CVSS 6.4)
- [CVE-2026-77871](https://cve.now/CVE-2026-77871.md): Post Snippets \<= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-75962](https://cve.now/CVE-2026-75962.md): Post SMTP \<= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user\_email' Parameter (Multisite Registration → Failed Email Log) (CVSS 7.2)
- [CVE-2026-12739](https://cve.now/CVE-2026-12739.md): WP Easy Pay \<= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 4.3)
- [CVE-2026-17149](https://cve.now/CVE-2026-17149.md): myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \<= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-15009](https://cve.now/CVE-2026-15009.md): Advanced File Manager \<= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter (CVSS 6.1)
- [CVE-2026-6627](https://cve.now/CVE-2026-6627.md): WPFormify \<= 1.1.1 - Missing Authorization (CVSS 8.2)
- [CVE-2026-11995](https://cve.now/CVE-2026-11995.md): Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder \<= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process\_bulk\_action() (CVSS 5.3)
- [CVE-2026-12144](https://cve.now/CVE-2026-12144.md): Wholesale for WooCommerce \<= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user\_role\_set' Parameter (CVSS 8.8)
- [CVE-2026-12738](https://cve.now/CVE-2026-12738.md): WP Easy Pay \<= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep\_draft\_confirm AJAX Action (CVSS 4.3)
- [CVE-2026-12097](https://cve.now/CVE-2026-12097.md): User Management \<= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification (CVSS 5.3)
- [CVE-2026-8607](https://cve.now/CVE-2026-8607.md): myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-7430](https://cve.now/CVE-2026-7430.md): Post Snippets \<= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import (CVSS 4.4)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2026-3090](https://cve.now/CVE-2026-3090.md): Post SMTP \<= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event\_type' (CVSS 7.2)
- [CVE-2026-2559](https://cve.now/CVE-2026-2559.md): Post SMTP \<= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite (CVSS 5.3)
- [CVE-2026-1674](https://cve.now/CVE-2026-1674.md): Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder \<= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save\_gutena\_forms\_schema() (CVSS 6.5)
- [CVE-2026-0550](https://cve.now/CVE-2026-0550.md): myCred \<= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred\_load\_coupon' Shortcode (CVSS 6.4)
- [CVE-2026-0832](https://cve.now/CVE-2026-0832.md): New User Approve \<= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure (CVSS 7.3)
- [CVE-2025-12718](https://cve.now/CVE-2025-12718.md): Quick Contact Form \<= 8.2.6 - Unauthenticated Open Mail Relay (CVSS 5.8)
- [CVE-2025-12361](https://cve.now/CVE-2025-12361.md): myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program \<= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-12362](https://cve.now/CVE-2025-12362.md): myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program \<= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval (CVSS 5.3)
- [CVE-2025-12887](https://cve.now/CVE-2025-12887.md): Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App \<= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update (CVSS 5.4)
- [CVE-2025-12770](https://cve.now/CVE-2025-12770.md): New User Approve \<= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling (CVSS 5.3)
- [CVE-2025-11833](https://cve.now/CVE-2025-11833.md): Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App \<= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure (CVSS 9.8)
- [CVE-2025-11244](https://cve.now/CVE-2025-11244.md): Password Protected \<= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing (CVSS 3.7)
- [CVE-2025-9219](https://cve.now/CVE-2025-9219.md): Post SMTP \<= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update (CVSS 4.3)
- [CVE-2025-0818](https://cve.now/CVE-2025-0818.md): Multiple elFinder Plugins \<= (Various Versions) - Directory Traversal to Arbitrary File Deletion (CVSS 6.5)
- [CVE-2025-3453](https://cve.now/CVE-2025-3453.md): Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products \<= 2.7.7 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-13844](https://cve.now/CVE-2024-13844.md): Post SMTP \<= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter (CVSS 4.9)
- [CVE-2024-13805](https://cve.now/CVE-2024-13805.md): Advanced File Manager \<= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-13713](https://cve.now/CVE-2024-13713.md): WPExperts Square For GiveWP \<= 1.3.1 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2025-0521](https://cve.now/CVE-2025-0521.md): Post SMTP \<= 3.0.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-13333](https://cve.now/CVE-2024-13333.md): Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5)
- [CVE-2024-11201](https://cve.now/CVE-2024-11201.md): myCred – Loyalty Points and Rewards plugin \<= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred\_send Shortcode (CVSS 6.4)
- [CVE-2024-11391](https://cve.now/CVE-2024-11391.md): Advanced File Manager \<= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5)
- [CVE-2024-10187](https://cve.now/CVE-2024-10187.md): myCred \<= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred\_link Shortcode (CVSS 6.4)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-8725](https://cve.now/CVE-2024-8725.md): Advanced File Manager \<= 5.2.8 - Authenticated (Subscriber+) Limited File Upload (CVSS 6.8)
- [CVE-2024-8126](https://cve.now/CVE-2024-8126.md): Advanced File Manager \<= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5)
- [CVE-2024-8704](https://cve.now/CVE-2024-8704.md): Advanced File Manager \<= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma\_locale (CVSS 7.2)
- [CVE-2024-8658](https://cve.now/CVE-2024-8658.md): myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification \<= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade (CVSS 5.3)
- [CVE-2024-5861](https://cve.now/CVE-2024-5861.md): WP Easy Pay (Free) \<= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection (CVSS 5.3)
- [CVE-2024-5598](https://cve.now/CVE-2024-5598.md): Advanced File Manager \<= 5.2.4 - Sensitive Information Exposure via Directory Listing (CVSS 7.5)
- [CVE-2024-1639](https://cve.now/CVE-2024-1639.md): License Manager for WooCommerce \<= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure (CVSS 6.5)
- [CVE-2024-5207](https://cve.now/CVE-2024-5207.md): POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \<= 2.9.3 - Authenticated (Administrator+) SQL Injection (CVSS 7.2)
- [CVE-2024-0437](https://cve.now/CVE-2024-0437.md): Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease \<= 2.6.6 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3)
- [CVE-2024-0656](https://cve.now/CVE-2024-0656.md): Password Protected \<= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2023-6875](https://cve.now/CVE-2023-6875.md): POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \<= 2.8.7 - Authorization Bypass via type connect-app API (CVSS 9.8)
- [CVE-2023-7027](https://cve.now/CVE-2023-7027.md): POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \<= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device (CVSS 7.2)
- [CVE-2023-6629](https://cve.now/CVE-2023-6629.md): POST SMTP Mailer \<= 2.8.6 - Reflected Cross-Site Scripting via msg (CVSS 6.1)
- [CVE-2021-4422](https://cve.now/CVE-2021-4422.md): POST SMTP Mailer \<= 2.0.20 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2023-3082](https://cve.now/CVE-2023-3082.md): Post SMTP \<= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2)
- [CVE-2021-4411](https://cve.now/CVE-2021-4411.md): WP EasyPay – Square for WordPress \<= 3.2.0 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2019-25150](https://cve.now/CVE-2019-25150.md): Email Templates \<= 1.3 - HTML Injection (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/saadiqbal
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.