CVE-2023-0177
Published Feb 13, 2023The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wh…
Vendor archive
wpdevart CVEs
Beta · best-effort40 CVEs tagged to vendor wpdevart — 3 Critical, 7 High, 28 Medium, 2 Low, 0 Unrated.
CVE-2022-3982
Published Dec 12, 2022The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files,…
CVE-2022-34656
Published Sep 6, 2022Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.
CVE-2022-1946
Published Jul 4, 2022The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated a…
CVE-2022-0876
Published Apr 25, 2022The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scriptin…
CVE-2022-0640
Published Mar 21, 2022The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-…
CVE-2022-0199
Published Feb 21, 2022The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to…
CVE-2022-0164
Published Feb 21, 2022The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated…
CVE-2021-25075
Published Feb 21, 2022The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX actio…
CVE-2021-24577
Published Oct 11, 2021The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon…
CVE-2021-34636
Published Sep 28, 2021The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown…
CVE-2021-24464
Published Aug 2, 2021The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role…
CVE-2021-24442
Published Jul 12, 2021The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL sta…
CVE-2018-10363
Published Jun 13, 2018An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the val…
CVE-2017-14125
Published Sep 25, 2017SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in a…
Showing 26-40 of 40 CVEsPage 2 of 2