Threat database

38 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3	EPSS 0.2%	CVE-2026-104079Envira Gallery · Missing Authorization Medium5.3EPSS 0.2%2026-10-09CVE Database V5CVE-2026-104079 Envira Gallery Lite versions before 1.16.2 have a missing authorization vulnerability in a REST endpoint used for gallery conversion. This flaw allows lower-privileged authenticated users to create and publish galleries without proper permissions. The endpoint only verifies edit permissions on the source post and uses a fixed publish status, enabling unauthorized publishing. Additionally, attackers can specify arbitrary image IDs without ownership checks, potentially publishing content they do not own. EPSS 0.2%Vulnerability Syed Balkhi	CVE Database V5	2026-10-09
High	7.1	EPSS 0.2%	CVE-2026-104394Charitable · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-104394 Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. EPSS 0.2%Vulnerability Syed Balkhi #cwe-79	CVE Database V5	2026-10-06
High	7.5	EPSS 0.4%	CVE-2026-94123NextGEN Gallery · Path Traversal High7.5EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94123 Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. EPSS 0.4%Vulnerability Syed Balkhi #cwe-22	CVE Database V5	2026-09-30
High	7.6	EPSS 0.3%	CVE-2026-95522Easy Digital Downloads · SQL Injection High7.6EPSS 0.3%2026-09-23CVE Database V5CVE-2026-95522 Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. EPSS 0.3%Vulnerability Syed Balkhi #cwe-89 #ghsa-m24x-544x-prhx	CVE Database V5	2026-09-23
High	8.5	EPSS 0.4%	CVE-2026-81287Charitable · SQL Injection High8.5EPSS 0.4%2026-08-31CVE Database V5CVE-2026-81287 Subscriber SQL Injection in Charitable <= 1.8.12.1 versions. EPSS 0.4%Vulnerability Syed Balkhi #cwe-89	CVE Database V5	2026-08-31
High	7.5	EPSS 0.3%	CVE-2026-73994Charitable · Missing Authorization High7.5EPSS 0.3%2026-08-18CVE Database V5CVE-2026-73994 Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. EPSS 0.3%Vulnerability Syed Balkhi #cwe-862	CVE Database V5	2026-08-18
High	7.1	EPSS 0.5%	CVE-2026-28141NextGEN Gallery · Cross-site Scripting High7.1EPSS 0.5%2026-08-06CVE Database V5CVE-2026-28141 CVE-2026-28141 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability affecting NextGEN Gallery versions up to and including 4.2.3. This vulnerability allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time. EPSS 0.5%Vulnerability Syed Balkhi #cwe-79 #ghsa-9v8v-v93j-cwvg	CVE Database V5	2026-08-06
Medium	4.9	EPSS 0.5%	CVE-2026-66476Easy Digital Downloads · Path Traversal Medium4.9EPSS 0.5%2026-07-27CVE Database V5CVE-2026-66476 Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. EPSS 0.5%Vulnerability Syed Balkhi #cwe-22	CVE Database V5	2026-07-27
High	7.5	EPSS 0.4%	CVE-2026-54837Intranet & Private Site – All-In-One Intranet · Missing Authorization High7.5EPSS 0.4%2026-06-26CVE Database V5CVE-2026-54837 Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions. EPSS 0.4%Vulnerability Syed Balkhi #cwe-862	CVE Database V5	2026-06-26
High	7.4	EPSS 0.3%	CVE-2026-52698PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget · Insertion of Sensitive Information Into Sent Data High7.4EPSS 0.3%2026-06-17CVE Database V5CVE-2026-52698 CVE-2026-52698 is a high-severity vulnerability in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget versions up to 4.2.3. It involves the insertion of sensitive subscriber data into sent data, leading to potential exposure of this information. The vulnerability is classified under CWE-201, indicating sensitive information exposure through data insertion. No official patch or remediation guidance is currently provided by the vendor. EPSS 0.3%Vulnerability Syed Balkhi #cwe-201	CVE Database V5	2026-06-17
High	8.1	EPSS 0.1%	CVE-2026-40764Contact Form by WPForms · Cross-Site Request Forgery (CSRF) High8.1EPSS 0.1%2026-04-15CVE Database V5CVE-2026-40764 Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2. EPSS 0.1%Vulnerability Syed Balkhi	CVE Database V5	2026-04-15
Medium	4.3	EPSS 0.3%	CVE-2026-39476User Feedback · Missing Authorization Medium4.3EPSS 0.3%2026-04-08CVE Database V5CVE-2026-39476 Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1. EPSS 0.3%Vulnerability Syed Balkhi	CVE Database V5	2026-04-08
High	7.6	EPSS 0.4%	CVE-2026-39475User Feedback · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Syed Balkhi… High7.6EPSS 0.4%2026-04-08CVE Database V5CVE-2026-39475 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1. EPSS 0.4%Vulnerability Syed Balkhi	CVE Database V5	2026-04-08
Medium	6.5	EPSS 0.2%	CVE-2026-25339Contact Form by WPForms · Insertion of Sensitive Information Into Sent Data Medium6.5EPSS 0.2%2026-03-25CVE Database V5CVE-2026-25339 Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7. EPSS 0.2%Vulnerability Syed Balkhi	CVE Database V5	2026-03-25
Medium	4.3	EPSS 0.3%	CVE-2026-32446Contact Form by WPForms · Missing Authorization Medium4.3EPSS 0.3%2026-03-13CVE Database V5CVE-2026-32446 Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3. EPSS 0.3%Vulnerability Syed Balkhi	CVE Database V5	2026-03-13
Medium	4.3	EPSS 0.2%	CVE-2026-24636Sugar Calendar (Lite) · Missing Authorization Medium4.3EPSS 0.2%2026-01-23CVE Database V5CVE-2026-24636 Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1. EPSS 0.2%Vulnerability Syed Balkhi	CVE Database V5	2026-01-23
High	7.6	EPSS 0.5%	CVE-2025-68496User Feedback · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Syed Balkhi… High7.6EPSS 0.5%2025-12-24CVE Database V5CVE-2025-68496 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0. EPSS 0.5%Vulnerability Syed Balkhi	CVE Database V5	2025-12-24
Medium	6.5	EPSS 0.3%	CVE-2025-64295All In One SEO Pack · Insertion of Sensitive Information Into Sent Data in Syed Balkhi All In One SEO Pack Medium6.5EPSS 0.3%2025-12-18CVE Database V5CVE-2025-64295 Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1. EPSS 0.3%Vulnerability Syed Balkhi	CVE Database V5	2025-12-18
High	8.5	EPSS 0.3%	CVE-2025-67950All In One SEO Pack · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Syed Balkhi… High8.5EPSS 0.3%2025-12-16CVE Database V5CVE-2025-67950 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n/a through <= 4.9.1. EPSS 0.3%Vulnerability Syed Balkhi	CVE Database V5	2025-12-16
Medium	5.3	EPSS 0.3%	CVE-2025-64635Feeds for YouTube · Missing Authorization Medium5.3EPSS 0.3%2025-12-16CVE Database V5CVE-2025-64635 Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0. EPSS 0.3%Vulnerability Syed Balkhi	CVE Database V5	2025-12-16

Showing 1–20 of 38 results