Web Dorado vulnerabilities
27 vulnerabilities
Known vulnerabilities in Web Dorado products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 19 products.
Products
19- Contact Form Maker4 vulnerabilities
- Event Calendar Wd2 vulnerabilities
- Form Maker2 vulnerabilities
- Spidervplayer2 vulnerabilities
- Wd Instagram Feed2 vulnerabilities
- Wdsocialwidgets2 vulnerabilities
- Web Dorado Spider Video Player2 vulnerabilities
- Wp Form Builder2 vulnerabilities
- Backup Wd1 vulnerabilities
- Contact Form1 vulnerabilities
- Ecommerce Wd1 vulnerabilities
- Event Calendar WD Version1 vulnerabilities
- Gallery Wd1 vulnerabilities
- Spider Calendar1 vulnerabilities
- Spider Event Calendar1 vulnerabilities
- Spider Facebook1 vulnerabilities
- Spidercatalog1 vulnerabilities
- Wd Widgettwitter1 vulnerabilities
- Spider Catalog0 vulnerabilities
CVE-2018-16164web-doradoevent_calendar_wd+2
EPSS score1.20%
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-25347web-doradocontact_form_makerEPSS score0.21%
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.CVE-2018-5991web-doradoform_makerEPSS score2.65%
SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798.CVE-2018-5981web-doradogallery_wdEPSS score2.65%
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.CVE-2018-10301web-doradowd_instagram_feed+1EPSS score0.94%
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.CVE-2018-10300web-doradowd_instagram_feed+1EPSS score0.94%
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.CVE-2018-10504web-doradoform_maker+1EPSS score4.42%
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.CVE-2021-24426unknownbackup by 10web – backup and restore plugin+2EPSS score0.63%
The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issueCVE-2021-24625unknownspidercatalog+2EPSS score1.52%
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a categoryCVE-2015-2798web-doradocontact_form_makerEPSS score3.26%
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2015-2562web-doradoecommerce_wdEPSS score38.72%
Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php.CVE-2015-2196web-doradospider_calendar+1EPSS score10.85%
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.CVE-2015-1582web-doradospider_facebook+1EPSS score1.65%
Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php.CVE-2015-4352web-doradoweb-dorado_spider_video_playerEPSS score0.64%
Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.CVE-2014-8584web-doradoweb-dorado_spider_video_player+1EPSS score1.89%
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2017-2224web-doradoevent_calendar_wd+1EPSS score1.47%
Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2017-7719web-doradospider_event_calendar+1EPSS score2.27%
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.CVE-2019-11557web-doradowp_form_builder+1EPSS score1.06%
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.CVE-2019-11591web-doradocontact_form+1EPSS score1.06%
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.CVE-2019-25734web-doradocontact_form_makerEPSS score0.89%
Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.