Syed Balkhi
Monthly
Unauthenticated cross-site scripting (XSS) in the Charitable WordPress plugin through version 1.8.12.3 allows remote attackers to inject arbitrary web scripts into pages viewed by victims, potentially leading to session hijacking or defacement. Exploitation requires user interaction (UI:R), such as clicking a crafted link, and impacts the victim's browser session rather than the server (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a moderate-priority issue per independent assessment.
Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.
Unauthenticated arbitrary file download in the NextGEN Gallery WordPress plugin affects every site running version 4.5.0 or earlier, allowing a remote attacker with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, base score 7.5) to retrieve files that are readable by the web server process. Rooted in a path-traversal weakness (CWE-22) in the plugin's file download handling, the impact is confined to confidentiality - typical targets are wp-config.php, database credentials, environment files, and backup archives - with no file write or code execution. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the reachable default-configuration attack path makes it a genuine priority rather than a paper-tiger high-CVSS issue.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in the PushEngage WordPress plugin (versions <= 4.2.3) allows authenticated low-privileged users to access subscriber information that should remain protected. The flaw, reported by Patchstack and tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects WordPress sites running the Web Push Notifications, eCommerce Automation & Chat Widget plugin and carries a CVSS 3.1 score of 7.4 with a scope change. No public exploit identified at time of analysis.
Cross-site request forgery in WPForms Lite up to version 1.10.0.2 allows unauthenticated attackers to perform unauthorized actions by tricking an authenticated administrator into clicking a malicious link, resulting in high confidentiality and integrity impact. No active exploitation or public proof-of-concept is currently known, and EPSS indicates very low exploitation probability (0.01%).
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.1) allows authenticated attackers with low privileges to extract database contents through malicious SQL queries. The vulnerability enables cross-scope exploitation with high confidentiality impact and limited availability disruption. EPSS probability is low (0.02%, 6th percentile), no public exploit identified at time of analysis, and exploitation requires authenticated access with low attack complexity.
Authenticated WordPress users holding only low-level permissions can create and publish Envira galleries they are not entitled to, and can bind image attachments they do not own into those galleries, when the site runs Envira Gallery Lite before 1.16.2. The root cause is a missing authorization check (CWE-862) in the plugin's gallery conversion REST endpoint, which validates edit rights on a source post instead of the capability required to create or publish galleries, and then writes a hard-coded publish status; caller-supplied image IDs are accepted without ownership verification. Impact is confined to integrity - unauthorized gallery creation and improper reuse of existing media - with no confidentiality or availability loss; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release.
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Missing authorization in Syed Balkhi User Feedback plugin versions up to 1.10.1 allows authenticated users to access sensitive feedback data and functionalities they should not have permission to view or modify, due to incorrectly configured access control security levels. With CVSS 4.3 and EPSS 0.02%, this represents a low-probability real-world exploitation risk, though it affects WordPress installations using this plugin.
Contact Form by WPForms versions up to 1.9.8.7 contain an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) that allows attackers to retrieve embedded sensitive data from contact form submissions. This information disclosure flaw affects the popular WordPress plugin maintained by Syed Balkhi, potentially exposing user data submitted through contact forms. While CVSS and EPSS scores are not yet published and KEV/POC status is unknown, the vulnerability was reported through Patchstack and tracked under ENISA EUVD-2026-15649.
Inadequate authorization controls in WPForms Contact Form plugin version 1.9.9.3 and earlier permit authenticated users to bypass access restrictions and view sensitive form data. An attacker with low-privileged credentials could leverage misconfigured access controls to access information they should not be permitted to view. No patch is currently available for this vulnerability.
Unauthenticated cross-site scripting (XSS) in the Charitable WordPress plugin through version 1.8.12.3 allows remote attackers to inject arbitrary web scripts into pages viewed by victims, potentially leading to session hijacking or defacement. Exploitation requires user interaction (UI:R), such as clicking a crafted link, and impacts the victim's browser session rather than the server (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a moderate-priority issue per independent assessment.
Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.
Unauthenticated arbitrary file download in the NextGEN Gallery WordPress plugin affects every site running version 4.5.0 or earlier, allowing a remote attacker with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, base score 7.5) to retrieve files that are readable by the web server process. Rooted in a path-traversal weakness (CWE-22) in the plugin's file download handling, the impact is confined to confidentiality - typical targets are wp-config.php, database credentials, environment files, and backup archives - with no file write or code execution. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the reachable default-configuration attack path makes it a genuine priority rather than a paper-tiger high-CVSS issue.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in the PushEngage WordPress plugin (versions <= 4.2.3) allows authenticated low-privileged users to access subscriber information that should remain protected. The flaw, reported by Patchstack and tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects WordPress sites running the Web Push Notifications, eCommerce Automation & Chat Widget plugin and carries a CVSS 3.1 score of 7.4 with a scope change. No public exploit identified at time of analysis.
Cross-site request forgery in WPForms Lite up to version 1.10.0.2 allows unauthenticated attackers to perform unauthorized actions by tricking an authenticated administrator into clicking a malicious link, resulting in high confidentiality and integrity impact. No active exploitation or public proof-of-concept is currently known, and EPSS indicates very low exploitation probability (0.01%).
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.1) allows authenticated attackers with low privileges to extract database contents through malicious SQL queries. The vulnerability enables cross-scope exploitation with high confidentiality impact and limited availability disruption. EPSS probability is low (0.02%, 6th percentile), no public exploit identified at time of analysis, and exploitation requires authenticated access with low attack complexity.
Authenticated WordPress users holding only low-level permissions can create and publish Envira galleries they are not entitled to, and can bind image attachments they do not own into those galleries, when the site runs Envira Gallery Lite before 1.16.2. The root cause is a missing authorization check (CWE-862) in the plugin's gallery conversion REST endpoint, which validates edit rights on a source post instead of the capability required to create or publish galleries, and then writes a hard-coded publish status; caller-supplied image IDs are accepted without ownership verification. Impact is confined to integrity - unauthorized gallery creation and improper reuse of existing media - with no confidentiality or availability loss; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release.
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Missing authorization in Syed Balkhi User Feedback plugin versions up to 1.10.1 allows authenticated users to access sensitive feedback data and functionalities they should not have permission to view or modify, due to incorrectly configured access control security levels. With CVSS 4.3 and EPSS 0.02%, this represents a low-probability real-world exploitation risk, though it affects WordPress installations using this plugin.
Contact Form by WPForms versions up to 1.9.8.7 contain an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) that allows attackers to retrieve embedded sensitive data from contact form submissions. This information disclosure flaw affects the popular WordPress plugin maintained by Syed Balkhi, potentially exposing user data submitted through contact forms. While CVSS and EPSS scores are not yet published and KEV/POC status is unknown, the vulnerability was reported through Patchstack and tracked under ENISA EUVD-2026-15649.
Inadequate authorization controls in WPForms Contact Form plugin version 1.9.9.3 and earlier permit authenticated users to bypass access restrictions and view sensitive form data. An attacker with low-privileged credentials could leverage misconfigured access controls to access information they should not be permitted to view. No patch is currently available for this vulnerability.