Totalsoft vulnerabilities

Products

• Ts Poll 3
• Event Calendar – Calendar (wordpress Plugin) 2
• Ts Poll – Survey, Versus Poll, Image Poll, Video Poll 2
• Video Gallery – Youtube Gallery, Vimeo, Video Portfolio, Image Portfolio And Image Gallery 2

Newest

• totalsoft ts poll WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-25428 4.4 MediumFebruary 19, 2026
• totalsoft portfolio gallery WordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerability CVE-2025-62098 5.4 MediumDecember 31, 2025
• totalsoft ts poll WordPress TS Poll plugin <= 2.5.5 - Broken Access Control vulnerability CVE-2025-68588 4.3 MediumDecember 24, 2025
• totalsoft ts poll – survey, versus poll, image poll, video poll TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter CVE-2025-3470 4.9 MediumApril 15, 2025
• totalsoft woocommerce pricing – product pricing WordPress WooCommerce Pricing – Product Pricing plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability CVE-2025-22632 7.1 HighFebruary 23, 2025
• total-soft video gallery, totalsoft video gallery – youtube gallery, vimeo, video portfolio, image portfolio and image gallery, video gallery youtube gallery and vimeo gallery +2 more YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection CVE-2024-10247 7.2 HighDecember 6, 2024
• total-soft video gallery, totalsoft video gallery – youtube gallery, vimeo, video portfolio, image portfolio and image gallery +1 more Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-9769 4.4 MediumDecember 6, 2024
• pollbytotalsoft ts poll TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injection CVE-2024-8625 7.2 HighOctober 21, 2024
• total-soft ts poll, totalsoft ts poll – survey, versus poll, image poll, video poll, poll survey +2 more TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter CVE-2024-9022 7.2 HighOctober 10, 2024
• total-soft event calendar, totalsoft event calendar – calendar (wordpress plugin) +1 more WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability CVE-2022-36390 4.1 MediumSeptember 21, 2022
• total-soft event calendar, totalsoft event calendar – calendar (wordpress plugin) +1 more WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability CVE-2022-38067 6.5 MediumSeptember 9, 2022