目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%
コーヒーを一杯おごる

Syed Balkhi 厂商漏洞列表 / CVE 中文分析 35

Syed Balkhi 厂商相关 35 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Syed Balkhi 主要运营 WordPress 生态插件业务，其项目因广泛使用而累计收录 35 条 CVE。历史漏洞多集中于未授权访问、跨站脚本及远程代码执行，常源于输入验证缺失或权限控制疏漏。部分高危事件涉及敏感数据泄露，凸显了第三方插件在安全审计上的短板。开发者需关注官方更新以修复已知缺陷，企业用户应严格评估集成风险，避免依赖未充分验证的代码组件。

上位製品 Syed Balkhi: aThemes Addons for Elementor User Feedback Contact Form by WPForms All In One SEO Pack Charitable Beacon Lead Magnets and Lead Capture Giveaways and Contests by RafflePress Sugar Calendar (Lite) WP Lightbox 2 WPForms Feeds for YouTube Smash Balloon Social Post Feed AffiliateWP – External Referral Links Compact Archives Floating Social Bar Simple Post Expiration ExactMetrics Easy Digital Downloads Custom Twitter Feeds (Tweets Widget) Table of Contents Plus
CVE IDタイトルCVSS深刻度公開日
CVE-2026-40764 WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability — Contact Form by WPFormsCWE-352 8.1 High2026-04-15
CVE-2026-39475 WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability — User FeedbackCWE-89 7.6 High2026-04-08
CVE-2026-39476 WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability — User FeedbackCWE-862 4.3 Medium2026-04-08
CVE-2026-25339 WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability — Contact Form by WPFormsCWE-201 6.5 Medium2026-03-25
CVE-2026-32446 WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability — Contact Form by WPFormsCWE-862 4.3 Medium2026-03-13
CVE-2026-24636 WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability — Sugar Calendar (Lite)CWE-862 4.3 Medium2026-01-23
CVE-2020-36919 WPForms 1.7.8 - Cross-Site Scripting (XSS) — WPFormsCWE-79 6.1 Medium2026-01-13
CVE-2025-68496 WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability — User FeedbackCWE-89 7.6 High2025-12-24
CVE-2025-64295 WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability — All In One SEO PackCWE-201 6.5 Medium2025-12-18
CVE-2025-67950 WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability — All In One SEO PackCWE-89 8.5 High2025-12-16
CVE-2025-64635 WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability — Feeds for YouTubeCWE-862 5.3 Medium2025-12-16
CVE-2025-66064 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability — Giveaways and Contests by RafflePressCWE-352 4.3 Medium2025-11-21
CVE-2025-49937 WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerability — Smash Balloon Social Post FeedCWE-862 4.3 Medium2025-10-22
CVE-2025-60112 WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability — aThemes Addons for ElementorCWE-79 6.5 Medium2025-09-26
CVE-2025-53460 WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability — AffiliateWP – External Referral LinksCWE-79 5.9 Medium2025-09-22
CVE-2025-58001 WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability — Compact ArchivesCWE-79 6.5 Medium2025-09-22
CVE-2025-58649 WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure Vulnerability — All In One SEO PackCWE-201 4.3 Medium2025-09-22
CVE-2025-58650 WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control Vulnerability — All In One SEO PackCWE-862 5.4 Medium2025-09-22
CVE-2025-49997 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability — Giveaways and Contests by RafflePressCWE-862 5.3 Medium2025-06-20
CVE-2025-47596 WordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability — Beacon Lead Magnets and Lead CaptureCWE-352 4.3 Medium2025-05-07
CVE-2025-47520 WordPress Charitable plugin <= 1.8.5.1 - Cross Site Scripting (XSS) Vulnerability — CharitableCWE-79 5.9 Medium2025-05-07
CVE-2025-46451 WordPress Floating Social Bar plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability — Floating Social BarCWE-79 5.9 Medium2025-04-24
CVE-2025-24637 WordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability — Beacon Lead Magnets and Lead CaptureCWE-79 7.1 High2025-04-17
CVE-2025-32158 WordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerability — aThemes Addons for ElementorCWE-98 7.5 High2025-04-10
CVE-2025-31734 WordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability — Simple Post ExpirationCWE-79 6.5 Medium2025-04-01
CVE-2025-22646 WordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerability — aThemes Addons for ElementorCWE-79 6.5 Medium2025-03-27
CVE-2025-30770 WordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) Vulnerability — CharitableCWE-79 6.5 Medium2025-03-27
CVE-2025-24750 WordPress ExactMetrics plugin <= 8.1.0 - Broken Access Control vulnerability — ExactMetricsCWE-862 5.4 Medium2025-01-24
CVE-2024-56276 WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability — Contact Form by WPFormsCWE-862 4.3 Medium2025-01-07
CVE-2023-40005 WordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access Control — Easy Digital DownloadsCWE-862 5.3 Medium2024-12-13

本页汇总了 Syed Balkhi 厂商截至目前公开的全部 35 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。