Wpdevart vulnerabilities

Products

• Booking Calendar, Appointment Booking System 16
• Booking Calendar 9
• Gallery 7
• Responsive Image Gallery, Gallery Album 5
• Coming Soon And Maintenance Mode 4
• Organization Chart 4
• Coming Soon And Maintenance Mode 3
• Gallery – Image And Video Gallery With Thumbnails 3
• Organization Chart 3
• Youtube Embed, Playlist And Popup By Wpdevart 3
• Contact Form Builder, Contact Widget 2
• Countdown And Countup\, Woocommerce Sales Timer 2
• Countdown Timer – Widget Countdown 2
• Poll\, Survey\, Questionnaire And Voting System 2
• Pricing Table Builder 2
• Pricing Table Builder 2
• Responsive Vertical Icon Menu 2
• Responsive Vertical Icon Menu 2
• Social Like Box And Page 2
• Widget Countdown 2
• Youtube Embed\, Playlist And Popup 2

Newest

• wpdevart countdown timer – widget countdown Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute CVE-2026-16495 6.4 MediumOctober 14, 2026
• unknown booking calendar, appointment booking system Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload CVE-2026-14334 8.8 HighAugust 19, 2026
• wpdevart booking calendar, appointment booking system WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-73395 6.5 MediumAugust 18, 2026
• wpdevart booking calendar, appointment booking system Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action CVE-2026-8840 5.3 MediumAugust 15, 2026
• wpdevart booking calendar, appointment booking system WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability CVE-2026-57778 5.3 MediumJuly 13, 2026
• wpdevart booking calendar, appointment booking system Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id' CVE-2026-15289 5.9 MediumJuly 10, 2026
• wpdevart organization chart WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-24597 4.3 MediumMay 25, 2026
• wpdevart contact form builder WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php CVE-2022-50959 5.1 MediumMay 10, 2026
• wpdevart booking calendar, appointment booking system WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability CVE-2026-25435 7.1 HighMarch 25, 2026
• wpdevart countdown timer – widget countdown Countdown Timer - Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-14555 6.4 MediumJanuary 10, 2026
• wpdevart booking calendar, appointment booking system WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability CVE-2025-67574 5.3 MediumDecember 9, 2025
• wpdevart pricing table builder WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-62886 7.1 HighOctober 27, 2025
• denis-de-bernardy auto thickbox, smub photo gallery, sliders, proofing and themes – nextgen gallery, wpdevart youtube embed, playlist and popup by wpdevart +2 more Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library CVE-2025-2537 6.4 MediumJuly 3, 2025
• wpdevart widget countdown WordPress Widget Countdown plugin <= 2.7.4 - Cross Site Scripting (XSS) Vulnerability CVE-2025-47443 6.5 MediumMay 7, 2025
• wpdevart widget countdown WordPress Widget Countdown plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability CVE-2025-24719 6.5 MediumJanuary 24, 2025
• wpdevart booking calendar pro wpdevart, booking calendar, appointment booking system +1 more Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' CVE-2024-12077 6.1 MediumJanuary 7, 2025
• wpdevart gallery, responsive image gallery, gallery album +1 more WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability CVE-2023-45631 4.3 MediumJanuary 2, 2025
• wpdevart booking calendar, booking calendar, appointment booking system +1 more Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection CVE-2024-10856 6.5 MediumDecember 24, 2024
• wpdevart booking calendar, appointment booking system, booking calendar +1 more WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability CVE-2023-24407 5.0 MediumDecember 9, 2024
• wpdevart booking calendar, appointment booking system, booking calendar +1 more Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload CVE-2024-9504 7.2 HighNovember 26, 2024
• wpdevart organization chart Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters CVE-2024-7355 4.9 MediumAugust 7, 2024
• wpdevart gallery, responsive image gallery, gallery album +1 more WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability CVE-2024-37542 5.4 MediumJuly 6, 2024
• contact form builder project form builder, wpdevart contact form builder, contact widget +1 more WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability CVE-2024-35747 5.3 MediumJune 10, 2024
• wpdevart gallery, responsive image gallery, gallery album +1 more WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - SQL Injection vulnerability CVE-2024-35750 8.5 HighJune 8, 2024
• wpdevart coming soon and maintenance mode WordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerability CVE-2023-49741 3.7 LowJune 4, 2024
• wpdevart booking calendar, appointment booking system, booking calendar +1 more WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability CVE-2023-24373 3.7 LowJune 3, 2024
• wpdevart gallery, responsive image gallery, gallery album +1 more WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-30550 7.1 HighMarch 31, 2024
• wpdevart gallery, responsive image gallery, gallery album +1 more WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability CVE-2024-31120 6.5 MediumMarch 31, 2024
• wpdevart countdown and countup, woocommerce sales timer, countdown and countup\, woocommerce sales timer +1 more WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS) CVE-2023-47533 5.9 MediumNovember 14, 2023
• wpdevart booking calendar, appointment booking system, booking calendar +1 more WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection CVE-2022-47428 6.7 MediumNovember 6, 2023
• wpdevart contact form builder, contact widget, contact form builder +1 more WordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) CVE-2023-46075 7.1 HighOctober 26, 2023
• unknown gallery – image and video gallery with thumbnails, wpdevart gallery +1 more WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) CVE-2023-45630 7.1 HighOctober 18, 2023
• unknown gallery – image and video gallery with thumbnails, wpdevart gallery - image and video gallery with thumbnails +1 more WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-45629 5.4 MediumOctober 16, 2023
• unknown pricing table builder AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi CVE-2023-0900 7.2 HighJune 5, 2023
• wpdevart organization chart WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) CVE-2023-24387 5.9 MediumApril 6, 2023
• wpdevart youtube embed, playlist and popup by wpdevart, youtube embed\, playlist and popup +1 more WordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS) CVE-2023-24002 5.9 MediumApril 6, 2023
• wpdevart image and video lightbox, image popup, download image and video lightbox\, image popup +1 more WordPress Image and Video Lightbox, Image PopUp Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS) CVE-2023-24004 5.9 MediumApril 6, 2023
• smplug-in social like box and page by wpdevart, wpdevart social like box and page +1 more WordPress Social Like Box and Page by WpDevArt Plugin <= 0.8.39 is vulnerable to Cross Site Scripting (XSS) CVE-2023-23972 5.9 MediumApril 6, 2023
• wpdevart responsive vertical icon menu WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS) CVE-2023-23870 5.9 MediumApril 4, 2023
• unknown gallery – image and video gallery with thumbnails, wpdevart image and video gallery with thumbnails +1 more WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) CVE-2022-47603 7.1 HighMarch 29, 2023
• wpdevart booking calendar, appointment booking system, booking calendar +1 more WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS) CVE-2022-47438 5.9 MediumMarch 29, 2023
• wpdevart responsive vertical icon menu WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-23983 5.4 MediumFebruary 28, 2023
• wpdevart organization chart WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-24384 4.3 MediumFebruary 23, 2023
• wpdevart booking calendar, appointment booking system, booking calendar +1 more WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-24388 5.4 MediumFebruary 17, 2023
• unknown social like box and page by wpdevart, wpdevart social like box and page +1 more Social Like Box and Page by WpDevArt < 0.8.41 - Contributor+ Stored XSS CVE-2023-0177 5.4 MediumFebruary 13, 2023
• unknown booking calendar, appointment booking system, wpdevart booking calendar +1 more Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload CVE-2022-3982 9.8 CriticalDecember 12, 2022
• wpdevart poll, survey, questionnaire and voting system (wordpress plugin), poll\, survey\, questionnaire and voting system +1 more WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability CVE-2022-34656 4.8 MediumSeptember 6, 2022
• wpdevart gallery, unknown gallery – image and video gallery with thumbnails +1 more Gallery < 2.0.0 - Reflected Cross-Site Scripting CVE-2022-1946 6.1 MediumJuly 4, 2022
• unknown social comments by wpdevart, wpdevart social comments +1 more Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site Scripting CVE-2022-0876 4.8 MediumApril 25, 2022
• wpdevart pricing table builder, unknown pricing table builder – ap pricing tables lite +1 more AP Pricing Tables Lite < 1.1.5 - Reflected Cross-Site Scripting CVE-2022-0640 6.1 MediumMarch 21, 2022
• Show olderLoading…