Wow Company vulnerabilities
59 vulnerabilities
Known vulnerabilities in Wow Company products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 30 products.
Products
30- Modal Window7 vulnerabilities
- Counter Box6 vulnerabilities
- Wp Coder6 vulnerabilities
- Button Generator5 vulnerabilities
- Button Generator – Easily Button Builder5 vulnerabilities
- Herd Effects5 vulnerabilities
- Float Menu4 vulnerabilities
- Side Menu Lite4 vulnerabilities
- Sticky Buttons4 vulnerabilities
- Bubble Menu3 vulnerabilities
- Popup Box3 vulnerabilities
- Bubble Menu – Circle Floating Menu2 vulnerabilities
- Floating Button2 vulnerabilities
- Hover Effects2 vulnerabilities
- Viral Signup2 vulnerabilities
- Wow Forms2 vulnerabilities
- Wow Skype Buttons2 vulnerabilities
- Calculator Builder1 vulnerabilities
- Calculator Builder1 vulnerabilities
- Counter Box (Wordpress)1 vulnerabilities
- Easy Digital Downloads1 vulnerabilities
- Easy Digital Downloads – Recent Purchases1 vulnerabilities
- Herd Effects (Wordpress Plugin)1 vulnerabilities
- Hover Effects – Easily Create Any Hover Effect (Wordpress Plugin)1 vulnerabilities
- Popup Box (Wordpress Plugin)1 vulnerabilities
- Side Menu Lite – Add Sticky Fixed Buttons1 vulnerabilities
- Woocommerce Recent Purchases1 vulnerabilities
- Wow Countdowns1 vulnerabilities
- Wow Viral Signups1 vulnerabilities
- Wpcalc1 vulnerabilities
CVE-2021-25054unknownwpcalc – create any online calculators+2
EPSS score1.32%
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.CVE-2021-25052unknownbutton generator – easily button builder+2EPSS score2.99%
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.CVE-2021-25051unknownmodal window – create popup modal window+2EPSS score0.77%
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.CVE-2021-25053unknownwp coder – add custom html, css and js code+2EPSS score0.67%
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.CVE-2021-25064unknownwow countdowns – easily create any countdowns, counters and timers+2EPSS score1.33%
The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection.CVE-2021-24628unknownwow forms – create any form with custom style+2EPSS score1.55%
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injectionCVE-2025-26760wordpresscalculator-builder+1EPSS score0.61%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder calculator-builder allows PHP Local File Inclusion.This issue affects Calculator Builder: from n/a through <= 1.6.2.CVE-2025-0897wordpressmodal-window+2EPSS score0.31%
The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-53258wordpresshover-effects+1EPSS score0.42%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wow-Company Hover Effects hover-effects allows SQL Injection.This issue affects Hover Effects: from n/a through <= 2.1.2.CVE-2025-24720wordpresssticky-buttons+1EPSS score0.19%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Buttons: from n/a through <= 4.1.1.CVE-2025-24717wordpressmodal-window+1EPSS score0.22%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: from n/a through <= 6.1.4.CVE-2025-24724wordpressside-menu-lite+1EPSS score0.19%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite side-menu-lite allows Cross Site Request Forgery.This issue affects Side Menu Lite: from n/a through <= 5.3.1.CVE-2025-24716wordpressmwp-herd-effect+1EPSS score0.21%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Herd Effects mwp-herd-effect allows Cross Site Request Forgery.This issue affects Herd Effects: from n/a through <= 6.2.1.CVE-2025-24699wordpresswp-coder+1EPSS score0.15%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a through <= 3.6.CVE-2025-24713wordpressbutton-generation+1EPSS score0.21%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through <= 3.1.1.CVE-2025-24715wordpresscounter-box+1EPSS score0.21%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through <= 2.0.5.CVE-2025-24711wordpresspopup-box+1EPSS score0.21%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Popup Box popup-box allows Cross Site Request Forgery.This issue affects Popup Box: from n/a through <= 3.2.4.CVE-2025-24714wordpressbubble-menu+1EPSS score0.21%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affects Bubble Menu – circle floating menu: from n/a through <= 4.0.2.CVE-2025-30912wordpressfloat-menu+1EPSS score0.18%
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Float menu float-menu allows Cross Site Request Forgery.This issue affects Float menu: from n/a through <= 6.1.2.CVE-2022-2388unknownwp coder – add custom html, css and js code+2EPSS score0.43%
The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack