Skip to content
OpenAdvisories

Vendor

wpcalc

8 known vulnerabilities.

Products

Modal Window – create popup modal window 3 Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress 2 WP Coder – Insert & Manage Code Snippets 1 Sticky Buttons – Floating Buttons Builder 1 Popup Box – Easily Create WordPress Popups 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.6
    CVE-2026-12115

    Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import

    The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated …

    wpcalc Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress Web / CMS
  • Medium 6.4
    CVE-2025-12122

    Popup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping on …

    wpcalc Popup Box – Easily Create WordPress Popups Web / CMS
  • Medium 4.4
    CVE-2024-13901

    Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site <= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting

    The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sa…

    wpcalc Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress Web / CMS
  • Medium 6.4
    CVE-2025-0897

    Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode

    The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input sanitization and output escaping on use…

    wpcalc Modal Window – create popup modal window Web / CMS
  • Medium 6.4
    CVE-2024-2457

    Modal Window – create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

    The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 5.3.8 due to insufficient input sanitization and output escaping on user supplie…

    wpcalc Modal Window – create popup modal window Web / CMS
  • Medium 4.4
    CVE-2024-0703

    Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

    The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for …

    wpcalc Sticky Buttons – Floating Buttons Builder Web / CMS
  • Medium 6.4
    CVE-2023-5161

    Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authen…

    wpcalc Modal Window – create popup modal window Web / CMS