Vendor

    Fahad Mahmood

    18 known vulnerabilities in products by Fahad Mahmood, 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Fahad Mahmood
    CriticalCVE-2025-12682

    Easy Upload Files During Checkout <= 2.9.8 - Unauthenticated Arbitrary JavaScript File Upload

    		9.8
    HighCVE-2024-3895

    Fahadmahmood WP Datepicker: Missing Authorization

    also in 1 other product

    		8.8
    MediumCVE-2022-1820

    Keep Backup Daily <= 2.0.2 - Reflected Cross-Site Scripting

    also in 1 other product

    		6.1
    HighCVE-2026-3368

    Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name

    		7.2
    MediumCVE-2026-6802

    Fahadmahmood Easy Upload Files During Checkout: Authorization Bypass Through User-Controlled Key

    		5.3
    MediumCVE-2024-12468

    WP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting

    also in 1 other product

    		6.1
    MediumCVE-2024-12635

    WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'

    also in 1 other product

    		6.5
    MediumCVE-2026-3878

    Fahadmahmood WP Docs: Cross-site Scripting

    		6.4
    MediumCVE-2024-10057

    Fahadmahmood RSS Feed Widget: Cross-site Scripting

    		6.4
    MediumCVE-2024-13387

    WP Responsive Tabs <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    		6.4
    MediumCVE-2025-7808

    WP Shopify < 1.5.4 - Reflected XSS

    		6.1
    MediumCVE-2025-8046

    Injection Guard < 1.2.8 - Reflected XSS via $_SERVER['REQUEST_URI']

    		6.1
    MediumCVE-2024-12405

    Export Customers Data <= 1.2.3 - Reflected Cross-Site Scripting

    		6.1
    MediumCVE-2024-35695

    WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    also in 1 other product

    		6.5
    MediumCVE-2026-3577

    Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title

    		4.4
    LowCVE-2026-3339

    Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter

    		2.7
    MediumCVE-2025-12075

    Fahadmahmood Order Splitter for WooCommerce: Missing Authorization

    		4.3
    MediumCVE-2024-9835

    RSS Feed Widget < 3.0.1 - Reflected XSS

    		4.8

    Products

    Products by Fahad Mahmood
    Keep Backup Daily30
    RSS Feed Widget30
    Wp Docs30