Wpdevart vulnerabilities, page 3
58 vulnerabilities
Known vulnerabilities in Wpdevart products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 26 products.
CVE-2023-47533wordpresscountdown-wpdevart-extended+1
EPSS score0.39%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions.CVE-2023-0900unknownpricing table builder+2EPSS score3.23%
The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.CVE-2023-0177unknownsocial like box and page by wpdevart+2EPSS score0.48%
The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2023-46075wordpresscontact-forms-builder+2EPSS score0.33%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions.CVE-2023-24373wordpressbooking-calendar+2EPSS score0.35%
External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.CVE-2023-24004wordpresslightbox-popup+2EPSS score0.39%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Image and Video Lightbox, Image PopUp plugin <= 2.1.5 versions.CVE-2023-24407wordpressbooking-calendar+2EPSS score0.50%
Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.CVE-2023-24388wordpressbooking-calendar+2EPSS score0.23%
Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).CVE-2023-24384wordpressorganization-chart+1EPSS score0.27%
Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions.CVE-2023-24002wordpressyoutube-video-player+2EPSS score0.39%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.3 versions.CVE-2023-24387wordpressorganization-chart+1EPSS score0.39%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Organization chart plugin <= 1.4.4 versions.CVE-2023-45631wordpressgallery-album+2EPSS score0.38%
Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.CVE-2023-45629wordpressgallery-album+1EPSS score0.22%
Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.CVE-2023-45630wordpressgallery-album+2EPSS score0.36%
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.CVE-2023-49741wordpresscoming-soon-page+1EPSS score0.34%
Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.CVE-2023-23972smplug-insocial like box and page by wpdevart+2EPSS score0.39%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39 versions.CVE-2023-23870wordpresswpdevart-vertical-menu+1EPSS score0.39%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 versions.CVE-2023-23983wordpresswpdevart-vertical-menu+1EPSS score0.23%
Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.