Skip to content
OpenAdvisories

Vendor

wpdevart

44 known vulnerabilities.

Products

Booking calendar, Appointment Booking System 14 Responsive Image Gallery, Gallery Album 5 Organization chart 4 Gallery – Image and Video Gallery with Thumbnails 3 Responsive Vertical Icon Menu 2 Contact Form Builder, Contact Widget 2 Countdown Timer – Widget Countdown 2 Widget Countdown 2 YouTube Embed, Playlist and Popup by WpDevArt 2 Countdown and CountUp, WooCommerce Sales Timer 1 Countdown and CountUp, WooCommerce Sales Timers 1 Poll, Survey, Questionnaire and Voting system 1 Poll, Survey, Questionnaire and Voting system (WordPress plugin) 1 Coming soon and Maintenance mode 1 Contact Form Builder 1 Image and Video Lightbox, Image PopUp 1 Pricing Table builder 1 Booking Calendar Pro WpDevArt 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.1
    CVE-2026-25435

    WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: fro…

    wpdevart Booking calendar, Appointment Booking System
  • High 7.1
    CVE-2025-62886

    WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Pricing Table builder wpdevart-pricing-table allows Stored XSS.This issue affects Pricing Table builder: from n/a through <= 1.5.3.

    wpdevart Pricing Table builder
  • High 7.2
    CVE-2024-9504

    Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

    The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it poss…

    wpdevart Booking calendar, Appointment Booking System Web / CMS
  • High 8.5
    CVE-2024-35750

    WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

    wpdevart Responsive Image Gallery, Gallery Album
  • High 7.1
    CVE-2024-30550

    WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Reflected XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

    wpdevart Responsive Image Gallery, Gallery Album
  • High 7.1
    CVE-2023-46075

    WordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions.

    wpdevart Contact Form Builder, Contact Widget
  • High 7.1
    CVE-2023-45630

    WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.

    wpdevart Gallery – Image and Video Gallery with Thumbnails
  • High 7.1
    CVE-2022-47603

    WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1 versions.

    wpdevart Gallery – Image and Video Gallery with Thumbnails
  • High 8.8
    CVE-2021-34636

    Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inje…

    wpdevart Countdown and CountUp, WooCommerce Sales Timers Web / CMS