Skip to content
OpenAdvisories

Vendor

totalsoft

10 known vulnerabilities.

Products

TS Poll 2 Video Gallery – YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery 2 TS Poll – Survey, Versus Poll, Image Poll, Video Poll 2 Event Calendar – Calendar (WordPress plugin) 2 Portfolio Gallery 1 WooCommerce Pricing – Product Pricing 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.4
    CVE-2026-25428

    WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <= 2.5.5.

    totalsoft TS Poll
  • Medium 5.4
    CVE-2025-62098

    WordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.

    totalsoft Portfolio Gallery
  • Medium 4.3
    CVE-2025-68588

    WordPress TS Poll plugin <= 2.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Poll: from n/a through <= 2.5.5.

    totalsoft TS Poll
  • Medium 4.9
    CVE-2025-3470

    TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter

    The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and including, 2.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient pr…

    totalsoft TS Poll – Survey, Versus Poll, Image Poll, Video Poll Web / CMS
  • Medium 4.4
    CVE-2024-9769

    Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possi…

    totalsoft Video Gallery – YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery Web / CMS
  • Medium 4.1
    CVE-2022-36390

    WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

    Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

    totalsoft Event Calendar – Calendar (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-38067

    WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability

    Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

    totalsoft Event Calendar – Calendar (WordPress plugin) Web / CMS