Syed Balkhi
Monthly
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in the PushEngage WordPress plugin (versions <= 4.2.3) allows authenticated low-privileged users to access subscriber information that should remain protected. The flaw, reported by Patchstack and tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects WordPress sites running the Web Push Notifications, eCommerce Automation & Chat Widget plugin and carries a CVSS 3.1 score of 7.4 with a scope change. No public exploit identified at time of analysis.
Cross-site request forgery in WPForms Lite up to version 1.10.0.2 allows unauthenticated attackers to perform unauthorized actions by tricking an authenticated administrator into clicking a malicious link, resulting in high confidentiality and integrity impact. No active exploitation or public proof-of-concept is currently known, and EPSS indicates very low exploitation probability (0.01%).
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.1) allows authenticated attackers with low privileges to extract database contents through malicious SQL queries. The vulnerability enables cross-scope exploitation with high confidentiality impact and limited availability disruption. EPSS probability is low (0.02%, 6th percentile), no public exploit identified at time of analysis, and exploitation requires authenticated access with low attack complexity.
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Missing authorization in Syed Balkhi User Feedback plugin versions up to 1.10.1 allows authenticated users to access sensitive feedback data and functionalities they should not have permission to view or modify, due to incorrectly configured access control security levels. With CVSS 4.3 and EPSS 0.02%, this represents a low-probability real-world exploitation risk, though it affects WordPress installations using this plugin.
Contact Form by WPForms versions up to 1.9.8.7 contain an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) that allows attackers to retrieve embedded sensitive data from contact form submissions. This information disclosure flaw affects the popular WordPress plugin maintained by Syed Balkhi, potentially exposing user data submitted through contact forms. While CVSS and EPSS scores are not yet published and KEV/POC status is unknown, the vulnerability was reported through Patchstack and tracked under ENISA EUVD-2026-15649.
Inadequate authorization controls in WPForms Contact Form plugin version 1.9.9.3 and earlier permit authenticated users to bypass access restrictions and view sensitive form data. An attacker with low-privileged credentials could leverage misconfigured access controls to access information they should not be permitted to view. No patch is currently available for this vulnerability.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in the PushEngage WordPress plugin (versions <= 4.2.3) allows authenticated low-privileged users to access subscriber information that should remain protected. The flaw, reported by Patchstack and tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects WordPress sites running the Web Push Notifications, eCommerce Automation & Chat Widget plugin and carries a CVSS 3.1 score of 7.4 with a scope change. No public exploit identified at time of analysis.
Cross-site request forgery in WPForms Lite up to version 1.10.0.2 allows unauthenticated attackers to perform unauthorized actions by tricking an authenticated administrator into clicking a malicious link, resulting in high confidentiality and integrity impact. No active exploitation or public proof-of-concept is currently known, and EPSS indicates very low exploitation probability (0.01%).
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.1) allows authenticated attackers with low privileges to extract database contents through malicious SQL queries. The vulnerability enables cross-scope exploitation with high confidentiality impact and limited availability disruption. EPSS probability is low (0.02%, 6th percentile), no public exploit identified at time of analysis, and exploitation requires authenticated access with low attack complexity.
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Missing authorization in Syed Balkhi User Feedback plugin versions up to 1.10.1 allows authenticated users to access sensitive feedback data and functionalities they should not have permission to view or modify, due to incorrectly configured access control security levels. With CVSS 4.3 and EPSS 0.02%, this represents a low-probability real-world exploitation risk, though it affects WordPress installations using this plugin.
Contact Form by WPForms versions up to 1.9.8.7 contain an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) that allows attackers to retrieve embedded sensitive data from contact form submissions. This information disclosure flaw affects the popular WordPress plugin maintained by Syed Balkhi, potentially exposing user data submitted through contact forms. While CVSS and EPSS scores are not yet published and KEV/POC status is unknown, the vulnerability was reported through Patchstack and tracked under ENISA EUVD-2026-15649.
Inadequate authorization controls in WPForms Contact Form plugin version 1.9.9.3 and earlier permit authenticated users to bypass access restrictions and view sensitive form data. An attacker with low-privileged credentials could leverage misconfigured access controls to access information they should not be permitted to view. No patch is currently available for this vulnerability.