CVEs we hold for Fahad
Records whose assigning authority named Fahad as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-81782WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood WP Docs
CVE-2026-75133Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_processFahad Mahmood Keep Backup Daily
CVE-2026-6802Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via…fahadmahmood Easy Upload Files During Checkout
CVE-2026-57419WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerabilityFahad Mahmood Stock Locations for WooCommerce
CVE-2026-3878WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'fahadmahmood WP Docs
CVE-2026-3577Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Titlefahadmahmood Keep Backup Daily
CVE-2026-3368Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Namefahadmahmood Injection Guard
CVE-2026-3339Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameterfahadmahmood Keep Backup Daily
CVE-2026-28567WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerabilityFahad Mahmood WP Sort Order
CVE-2026-25332WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerabilityFahad Mahmood Endless Posts Navigation
CVE-2026-24990WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerabilityFahad Mahmood WP Docs
CVE-2025-69349WordPress RSS Feed Widget plugin <= 3.0.2 - Broken Access Control vulnerabilityFahad Mahmood RSS Feed Widget
CVE-2025-62078WordPress Easy Upload Files During Checkout plugin <= 3.0.0 - Broken Access Control vulnerabilityFahad Mahmood Easy Upload Files During Checkout
CVE-2025-47463WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control VulnerabilityFahad Mahmood Stock Locations for WooCommerce
CVE-2025-31417WordPress WP Docs plugin < 2.2.7 - Broken Access Control vulnerabilityFahad Mahmood WP Docs
CVE-2025-31089WordPress Order Splitter for WooCommerce plugin <= 5.3.0 - SQL Injection VulnerabilityFahad Mahmood Order Splitter for WooCommerce
CVE-2025-30999WordPress External Store for Shopify plugin <= 1.5.9 - Local File Inclusion vulnerabilityFahad Mahmood External Store for Shopify
CVE-2025-26779WordPress Keep Backup Daily plugin <= 2.1.0 - Arbitrary File Download vulnerabilityFahad Mahmood Keep Backup Daily
CVE-2025-26751WordPress Alphabetic Pagination Plugin <= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFahad Mahmood Alphabetic Pagination
CVE-2025-12682Easy Upload Files During Checkout <= 2.9.8 - Unauthenticated Arbitrary JavaScript File Uploadfahadmahmood Easy Upload Files During Checkout
CVE-2025-12075Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information…fahadmahmood Order Splitter for WooCommerce
CVE-2024-56288WordPress WP Docs plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood WP Docs
CVE-2024-56223WordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerabilityFahad Mahmood Gulri Slider
CVE-2024-54344WordPress WP Quick Shop plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFahad Mahmood WP Quick Shop
CVE-2024-49629WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerabilityFahad Mahmood Endless Posts Navigation
CVE-2024-48024WordPress Keep Backup Daily plugin <= 2.1.3 - Sensitive Data Exposure vulnerabilityFahad Mahmood Keep Backup Daily
CVE-2024-47321WordPress WP Datepicker plugin <= 2.1.1 - Broken Access Control vulnerabilityFahad Mahmood WP Datepicker
CVE-2024-44042WordPress WP Datepicker plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood WP Datepicker
CVE-2024-3895WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatefahadmahmood WP Datepicker
CVE-2024-35696WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood WP Docs
CVE-2024-35695WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood WP Docs
CVE-2024-32690WordPress RSS Feed Widget plugin <= 2.9.7 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood RSS Feed Widget
CVE-2024-31294WordPress WP Sort Order plugin <= 1.3.1 - Broken Access Control vulnerabilityFahad Mahmood WP Sort Order
CVE-2024-22153WordPress Stock Locations for WooCommerce Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS)Fahad Mahmood & Alexandre Faustino Stock Locations for…
CVE-2024-13387WP Responsive Tabs <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingfahadmahmood WP Responsive Tabs
CVE-2024-12635WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'fahadmahmood WP Docs
CVE-2024-12405Export Customers Data <= 1.2.3 - Reflected Cross-Site Scriptingfahadmahmood Export Customers Data
CVE-2024-10057RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcodefahadmahmood RSS Feed Widget
CVE-2023-32574WordPress Injection Guard plugin <= 1.2.1 - Broken Access Control vulnerabilityFahad Mahmood Injection Guard
CVE-2023-32106WordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)Fahad Mahmood WP Docs
CVE-2022-44736WordPress Chameleon plugin <= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityFahad Mahmood Chameleon (WordPress plugin)
CVE-2022-1820Keep Backup Daily <= 2.0.2 - Reflected Cross-Site Scriptingfahadmahmood Keep Backup Daily
44 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.