Lucene search

K

Wpdevart Security Vulnerabilities

cve
cve

CVE-2023-49741

Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through...

3.7CVSS

7.2AI Score

0.0004EPSS

2024-06-04 11:15 AM
57
cve
cve

CVE-2024-35750

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through...

8.5CVSS

8.9AI Score

0.0004EPSS

2024-06-08 01:15 PM
21
cve
cve

CVE-2023-24373

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through...

3.7CVSS

7.2AI Score

0.0004EPSS

2024-06-03 10:15 PM
17
cve
cve

CVE-2024-30550

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Reflected XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through...

7.1CVSS

9.3AI Score

0.0004EPSS

2024-03-31 08:15 PM
31
cve
cve

CVE-2024-31120

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Stored XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through...

6.5CVSS

9.1AI Score

0.0004EPSS

2024-03-31 07:15 PM
28
cve
cve

CVE-2024-35747

Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through...

5.3CVSS

5.4AI Score

0.0005EPSS

2024-06-10 05:16 PM
24
cve
cve

CVE-2023-45629

Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3...

8.8CVSS

8.8AI Score

0.001EPSS

2023-10-16 09:15 AM
26
cve
cve

CVE-2023-47533

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2...

5.9CVSS

4.9AI Score

0.0004EPSS

2023-11-14 09:15 PM
43
cve
cve

CVE-2022-47428

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through...

9.8CVSS

9.7AI Score

0.001EPSS

2023-11-06 08:15 AM
7
cve
cve

CVE-2023-24002

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.3...

5.9CVSS

4.8AI Score

0.001EPSS

2023-04-06 09:15 AM
20
cve
cve

CVE-2022-47438

Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3...

5.9CVSS

5.2AI Score

0.001EPSS

2023-03-29 01:15 PM
21
cve
cve

CVE-2023-23870

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8...

5.9CVSS

4.8AI Score

0.001EPSS

2023-04-04 01:15 PM
12
cve
cve

CVE-2023-24388

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit,...

5.4CVSS

5.5AI Score

0.0005EPSS

2023-02-17 03:15 PM
17
cve
cve

CVE-2023-24004

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Image and Video Lightbox, Image PopUp plugin <= 2.1.5...

5.9CVSS

4.8AI Score

0.001EPSS

2023-04-06 09:15 AM
18
cve
cve

CVE-2022-47603

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1...

7.1CVSS

6AI Score

0.001EPSS

2023-03-29 07:15 PM
20
cve
cve

CVE-2023-24387

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Organization chart plugin <= 1.4.4...

5.9CVSS

4.8AI Score

0.001EPSS

2023-04-06 11:15 AM
18
cve
cve

CVE-2023-24384

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4...

8.8CVSS

8.8AI Score

0.001EPSS

2023-02-23 03:15 PM
15
cve
cve

CVE-2023-23983

Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme...

5.4CVSS

5.6AI Score

0.0005EPSS

2023-02-28 03:15 PM
14
cve
cve

CVE-2023-0900

The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as...

7.2CVSS

7.4AI Score

0.012EPSS

2023-06-05 02:15 PM
21
cve
cve

CVE-2022-3982

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve...

9.8CVSS

9.6AI Score

0.236EPSS

2022-12-12 06:15 PM
37
cve
cve

CVE-2022-0164

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed...

4.3CVSS

4.6AI Score

0.001EPSS

2022-02-21 11:15 AM
50
cve
cve

CVE-2023-0177

The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

5.4CVSS

5.3AI Score

0.001EPSS

2023-02-13 03:15 PM
22
cve
cve

CVE-2023-23972

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39...

5.9CVSS

4.8AI Score

0.001EPSS

2023-04-06 06:15 AM
11
cve
cve

CVE-2023-46075

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6...

7.1CVSS

6AI Score

0.0005EPSS

2023-10-26 01:15 PM
21
cve
cve

CVE-2023-45630

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3...

7.1CVSS

5.7AI Score

0.0005EPSS

2023-10-18 02:15 PM
17
cve
cve

CVE-2022-34656

Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at...

4.8CVSS

4.9AI Score

0.001EPSS

2022-09-06 06:15 PM
25
3
cve
cve

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting...

6.1CVSS

6AI Score

0.001EPSS

2022-07-04 01:15 PM
40
16
cve
cve

CVE-2022-0876

The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is...

4.8CVSS

4.8AI Score

0.001EPSS

2022-04-25 04:16 PM
54
cve
cve

CVE-2022-0640

The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site...

6.1CVSS

6.2AI Score

0.001EPSS

2022-03-21 07:15 PM
60
cve
cve

CVE-2022-0199

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF...

4.3CVSS

4.6AI Score

0.001EPSS

2022-02-21 11:15 AM
70
cve
cve

CVE-2021-25075

The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such...

3.5CVSS

4AI Score

0.001EPSS

2022-02-21 11:15 AM
69
cve
cve

CVE-2021-24577

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored...

5.4CVSS

5.3AI Score

0.001EPSS

2021-10-11 11:15 AM
24
cve
cve

CVE-2021-34636

The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions...

8.8CVSS

8.5AI Score

0.001EPSS

2021-09-28 02:15 PM
19
cve
cve

CVE-2021-24464

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting...

5.4CVSS

5.2AI Score

0.001EPSS

2021-08-02 11:15 AM
19
4
cve
cve

CVE-2021-24442

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection...

9.8CVSS

9.8AI Score

0.104EPSS

2021-07-12 08:15 PM
29
4
cve
cve

CVE-2018-10363

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as...

7.5CVSS

7.5AI Score

0.002EPSS

2018-06-13 06:29 PM
16
cve
cve

CVE-2017-14125

SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to...

9.8CVSS

10AI Score

0.002EPSS

2017-09-25 05:29 PM
24