# cve.now: Syed Balkhi

The newest entries naming Syed Balkhi as an affected vendor (up to 200), of 45 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104079](https://cve.now/CVE-2026-104079.md): Envira Gallery Lite \< 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint (CVSS 5.3)
- [CVE-2026-104394](https://cve.now/CVE-2026-104394.md): WordPress Charitable plugin \<= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-94123](https://cve.now/CVE-2026-94123.md): WordPress NextGEN Gallery plugin \<= 4.5.0 - Arbitrary File Download vulnerability (CVSS 7.5)
- [CVE-2026-95522](https://cve.now/CVE-2026-95522.md): WordPress Easy Digital Downloads plugin \<= 3.7.0 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-81287](https://cve.now/CVE-2026-81287.md): WordPress Charitable plugin \<= 1.8.12.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-73994](https://cve.now/CVE-2026-73994.md): WordPress Charitable plugin \<= 1.8.11.3 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-28141](https://cve.now/CVE-2026-28141.md): WordPress NextGEN Gallery plugin \<= 4.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66476](https://cve.now/CVE-2026-66476.md): WordPress Easy Digital Downloads plugin \<= 3.6.9 - Arbitrary File Deletion vulnerability (CVSS 4.9)
- [CVE-2026-54837](https://cve.now/CVE-2026-54837.md): WordPress Intranet & Private Site – All-In-One Intranet plugin \<= 1.8.1 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-52698](https://cve.now/CVE-2026-52698.md): WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin \<= 4.2.3 - Sensitive Data Exposure vulnerability (CVSS 7.4)
- [CVE-2026-40764](https://cve.now/CVE-2026-40764.md): WordPress Contact Form by WPForms plugin \<= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.1)
- [CVE-2026-39476](https://cve.now/CVE-2026-39476.md): WordPress User Feedback plugin \<= 1.10.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-39475](https://cve.now/CVE-2026-39475.md): WordPress User Feedback plugin \<= 1.10.1 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-25339](https://cve.now/CVE-2026-25339.md): WordPress Contact Form by WPForms plugin \<= 1.9.8.7 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-32446](https://cve.now/CVE-2026-32446.md): WordPress Contact Form by WPForms plugin \<= 1.9.9.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-24636](https://cve.now/CVE-2026-24636.md): WordPress Sugar Calendar (Lite) plugin \<= 3.9.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2020-36919](https://cve.now/CVE-2020-36919.md): WPForms 1.7.8 - Cross-Site Scripting (XSS) (CVSS 5.1)
- [CVE-2025-68496](https://cve.now/CVE-2025-68496.md): WordPress User Feedback plugin \<= 1.10.0 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-64295](https://cve.now/CVE-2025-64295.md): WordPress All In One SEO Pack plugin \<= 4.8.6.1 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2025-67950](https://cve.now/CVE-2025-67950.md): WordPress All In One SEO Pack plugin \<= 4.9.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-64635](https://cve.now/CVE-2025-64635.md): WordPress Feeds for YouTube plugin \<= 2.4.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-66064](https://cve.now/CVE-2025-66064.md): WordPress Giveaways and Contests by RafflePress plugin \<= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-49937](https://cve.now/CVE-2025-49937.md): WordPress Smash Balloon Social Post Feed plugin \<= 4.3.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-60112](https://cve.now/CVE-2025-60112.md): WordPress aThemes Addons for Elementor Plugin \<= 1.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-53460](https://cve.now/CVE-2025-53460.md): WordPress AffiliateWP – External Referral Links Plugin \<= 1.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-58001](https://cve.now/CVE-2025-58001.md): WordPress Compact Archives plugin \<= 4.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-58649](https://cve.now/CVE-2025-58649.md): WordPress All In One SEO Pack Plugin \<= 4.8.7.1 - Sensitive Data Exposure Vulnerability (CVSS 4.3)
- [CVE-2025-58650](https://cve.now/CVE-2025-58650.md): WordPress All In One SEO Pack Plugin \<= 4.8.7.1 - Broken Access Control Vulnerability (CVSS 5.4)
- [CVE-2025-49997](https://cve.now/CVE-2025-49997.md): WordPress Giveaways and Contests by RafflePress plugin \<= 1.12.18 - Broken Access Control + CSRF Vulnerability (CVSS 5.3)
- [CVE-2025-47596](https://cve.now/CVE-2025-47596.md): WordPress Beacon Lead Magnets and Lead Capture plugin \<= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-47520](https://cve.now/CVE-2025-47520.md): WordPress Charitable plugin \<= 1.8.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-46451](https://cve.now/CVE-2025-46451.md): WordPress Floating Social Bar plugin \<= 1.1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-24637](https://cve.now/CVE-2025-24637.md): WordPress Beacon Lead Magnets and Lead Capture Plugin \<= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-32158](https://cve.now/CVE-2025-32158.md): WordPress aThemes Addons for Elementor plugin \<= 1.1.3 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-31734](https://cve.now/CVE-2025-31734.md): WordPress Simple Post Expiration plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-22646](https://cve.now/CVE-2025-22646.md): WordPress aThemes Addons for Elementor plugin \<= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-30770](https://cve.now/CVE-2025-30770.md): WordPress Charitable plugin \<= 1.8.4.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-24750](https://cve.now/CVE-2025-24750.md): WordPress ExactMetrics plugin \<= 8.1.0 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-56276](https://cve.now/CVE-2024-56276.md): WordPress WPForms Lite plugin \<= 1.9.2.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-40005](https://cve.now/CVE-2023-40005.md): WordPress Easy Digital Downloads plugin \<= 3.1.5 - Broken Access Control (CVSS 5.3)
- [CVE-2023-50887](https://cve.now/CVE-2023-50887.md): WordPress User Feedback plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-51675](https://cve.now/CVE-2024-51675.md): WordPress aThemes Addons for Elementor plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-49685](https://cve.now/CVE-2024-49685.md): WordPress Custom Twitter Feeds plugin \<= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-49250](https://cve.now/CVE-2024-49250.md): WordPress Table of Contents Plus plugin \<= 2408 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2023-45747](https://cve.now/CVE-2023-45747.md): WordPress WP Lightbox 2 Plugin \<= 3.0.6.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/syed-balkhi
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.