Wpdevart - vulnerabilities (CVEs)

58 CVEs in 36 products, 1 in the last 30 days, newest from 2026-10-14.

Products

Appointment Booking System - 14 CVEs
Booking Calendar - 14 CVEs
Gallery - 7 CVEs
Gallery Album - 5 CVEs
Responsive Image Gallery - 5 CVEs
Organization Chart - 4 CVEs
Coming Soon And Maintenance Mode - 3 CVEs
Gallery Image And Video Gallery With Thumbnails - 3 CVEs
Contact Form Builder - 2 CVEs
Contact Widget - 2 CVEs
Countdown And Countup - 2 CVEs
Countdown And Countup, Woocommerce Sales Timer - 2 CVEs
Countdown Timer Widget Countdown - 2 CVEs
Playlist And Popup By Wpdevart - 2 CVEs
Poll - 2 CVEs
Poll, Survey, Questionnaire And Voting System - 2 CVEs
Pricing Table Builder - 2 CVEs
Responsive Vertical Icon Menu - 2 CVEs
Social Like Box And Page - 2 CVEs
Survey - 2 CVEs
Widget Countdown - 2 CVEs
Youtube Embed - 2 CVEs
Youtube Embed, Playlist And Popup - 2 CVEs
Booking Calendar Pro Wpdevart - 1 CVEs
Download Image And Video Lightbox, Image Popup - 1 CVEs
Duplicate Page Or Post - 1 CVEs
Gallery - Image And Video Gallery With Thumbnails - 1 CVEs
Image And Video Gallery With Thumbnails - 1 CVEs
Image And Video Lightbox - 1 CVEs
Image Popup - 1 CVEs
Questionnaire And Voting System - 1 CVEs
Questionnaire And Voting System Wordpress Plugin - 1 CVEs
Responsive Image Gallery Gallery Album - 1 CVEs
Social Comments - 1 CVEs
Woocommerce Sales Timer - 1 CVEs
Woocommerce Sales Timers - 1 CVEs

Newest CVEs of Wpdevart

CVE-2026-16495 - CVSS 6.4 (medium), 2026-10-14: The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all…
CVE-2026-73395 - CVSS 6.5 (medium), 2026-08-18: Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
CVE-2026-8840 - CVSS 5.3 (medium), 2026-08-15: The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This…
CVE-2026-57778 - CVSS 5.3 (medium), 2026-07-13: Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access…
CVE-2026-15289 - CVSS 5.9 (medium), 2026-07-10: The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevart_id’ parameter in all…
CVE-2026-24597 - CVSS 4.3 (medium), 2026-05-25: Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery. This issue affects Organization chart: from…
CVE-2022-50959 - CVSS 6.1 (medium), 2026-05-10: WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts…
CVE-2026-25435 - CVSS 7.1 (high), 2026-03-25: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking calendar, Appointment Booking System…
CVE-2025-14555 - CVSS 6.4 (medium), 2026-01-10: The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdevart_countdown' shortcode in…
CVE-2025-67574 - CVSS 5.3 (medium), 2025-12-09: Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access…
CVE-2025-62886 - CVSS 7.1 (high), 2025-10-27: Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Pricing Table builder wpdevart-pricing-table allows Stored XSS.This issue affects Pricing Table…
CVE-2025-2537 - CVSS 6.4 (medium), 2025-07-03: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various…
CVE-2025-47443 - CVSS 6.5 (medium), 2025-05-07: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored…
CVE-2025-24719 - CVSS 6.5 (medium), 2025-01-24: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored…
CVE-2024-12077 - CVSS 6.1 (medium), 2025-01-07: The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all…
CVE-2023-45631 - CVSS 5.4 (medium), 2025-01-02: Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security…
CVE-2024-10856 - CVSS 6.5 (medium), 2024-12-24: The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in…
CVE-2023-24407 - CVSS 8.8 (high), 2024-12-09: Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security…
CVE-2024-9504 - CVSS 7.2 (high), 2024-11-26: The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to,…
CVE-2024-7355 - CVSS 5.4 (medium), 2024-08-07: The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all…
CVE-2024-37542 - CVSS 6.3 (medium), 2024-07-06: Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a…
CVE-2024-35747 - CVSS 5.3 (medium), 2024-06-10: Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This…
CVE-2024-35750 - CVSS 8.8 (high), 2024-06-08: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This…
CVE-2023-49741 - CVSS 3.7 (low), 2024-06-04: Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by…
CVE-2023-24373 - CVSS 9.8 (critical), 2024-06-03: External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden…
CVE-2024-30550 - CVSS 7.1 (high), 2024-03-31: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows…
CVE-2024-31120 - CVSS 6.5 (medium), 2024-03-31: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows…
CVE-2023-47533 - CVSS 5.9 (medium), 2023-11-14: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions.
CVE-2022-47428 - CVSS 9.8 (critical), 2023-11-06: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System…
CVE-2023-46075 - CVSS 7.1 (high), 2023-10-26: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions.