Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wpdevart compares to other vendors in security performance

View Risk Score →

Software

wpdevart booking calendar wordpress
6
wpdevart gallery wordpress
6
wpdevart booking calendar, appointment booking system
5
wpdevart coming soon and maintenance mode
4
wpdevart organization chart wordpress
3
wpdevart responsive image gallery, gallery album
3
wpdevart pricing table builder
2
wpdevart responsive vertical icon menu wordpress
2
wpdevart widget countdown
2
wpdevart booking calendar
1
wpdevart booking calendar (appointment booking system)
1
wpdevart contact form builder wordpress
1
wpdevart countdown and countup, woocommerce sales timer
1
wpdevart countdown and countup\, woocommerce sales timer wordpress
1
wpdevart download image and video lightbox\, image popup wordpress
1
wpdevart duplicate page or post
1
wpdevart gallery - image and video gallery with thumbnails
1
wpdevart gallery - image and video gallery with thumbnails wordpress
1
wpdevart gallery album
1
wpdevart image and video gallery with thumbnails wordpress
1
wpdevart poll, survey, questionnaire and voting system
1
wpdevart poll\, survey\, questionnaire and voting system wordpress
1
wpdevart responsive image gallery
1
wpdevart social comments
1
wpdevart social like box and page wordpress
1
wpdevart wpdevart organization chart
1
wpdevart wpdevart-pricing-table
1
wpdevart youtube embed, playlist and popup
1
wpdevart youtube embed\, playlist and popup wordpress
1

WpDevArt Booking calendar, Appointment Booking SystemBooking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

Risk 19
Severity
5.3
EPSS
0.32%
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enablepsuccessapproval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.

First published (updated )
CVE-2026-8840

WpDevArt WpDevArt Organization chartWordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability

Risk 22
Severity
4.3
CSRF
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery.

This issue affects Organization chart: from n/a through 1.7.5.

First published (updated )
CVE-2026-24597

WpDevArt Booking calendar, Appointment Booking SystemWordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability

Risk 27
Severity
5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.

First published (updated )
CVE-2026-57778

WpDevArt Responsive Image Gallery, Gallery AlbumWordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Risk 34
Severity
6.5
EPSS
0.04%
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Stored XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

First published (updated )
CVE-2024-31120

WpDevArt Responsive Image Gallery, Gallery AlbumWordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 36
Severity
7.1
EPSS
0.04%
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Reflected XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

First published (updated )
CVE-2024-30550

WpDevArt Gallery WordpressWordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.

First published (updated )
CVE-2023-45630

WpDevArt Booking Calendar WordpressWordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Risk 34
Severity
5.4
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).

1 / 2

Remedy

Update to 3.2.4 or a higher version.
First published (updated )
CVE-2023-24388

WpDevArt Booking Calendar WordpressWordPress Booking calendar, Appointment Booking System plugin <= 3.2.7 - SQL Injection

Risk 86
Severity
9.8
SQL Injection
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

A vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.7.

Remedy

Update to 3.2.8 or a higher version.
First published (updated )
CVE-2022-47428

WpDevArt Booking Calendar (Appointment Booking System)WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.

First published (updated )
CVE-2026-25435

WpDevArt Booking calendar, Appointment Booking SystemWordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability

Risk 27
Severity
5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.

First published (updated )
CVE-2025-67574

WpDevArt wpdevart-pricing-tableWordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability

Risk 50
Severity
7.1
CSRF, XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Pricing Table builder wpdevart-pricing-table allows Stored XSS.This issue affects Pricing Table builder: from n/a through <= 1.5.3.

First published (updated )
CVE-2025-62886

WpDevArt Widget CountdownWordPress Widget Countdown plugin <= 2.7.4 - Cross Site Scripting (XSS) Vulnerability

Risk 34
Severity
6.5
EPSS
0.03%
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown allows Stored XSS. This issue affects Widget Countdown: from n/a through 2.7.4.

1 / 2
Source: NVD

Remedy

Update the WordPress Widget Countdown plugin to the latest available version (at least 2.7.5).
First published (updated )
CVE-2025-47443

WpDevArt Widget CountdownWordPress Widget Countdown plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

Risk 26
Severity
6.5
EPSS
0.04%
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.1.

Remedy

Update the WordPress Widget Countdown wordpress plugin to the latest available version (at least 2.7.2).
First published (updated )
CVE-2025-24719

WpDevArt Gallery WordpressWordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

Risk 46
Severity
6.3
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

First published (updated )
CVE-2024-37542

WpDevArt Gallery WordpressWordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - SQL Injection vulnerability

Risk 79
Severity
8.8
SQL Injection
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

First published (updated )
CVE-2024-35750

WpDevArt Coming soon and Maintenance modeWordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerability

Risk 20
Severity
3.7
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.

Remedy

Update to 3.7.4 or a higher version.
First published (updated )
CVE-2023-49741

WpDevArt Countdown And Countup\, Woocommerce Sales Timer WordpressWordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)

Risk 40
Severity
5.9
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions.

First published (updated )
CVE-2023-47533

WpDevArt Contact Form Builder WordpressWordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions.

First published (updated )
CVE-2023-46075

WpDevArt Gallery WordpressWordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

Risk 34
Severity
5.4
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

1 / 2
Source: NVD
First published (updated )
CVE-2023-45631

Total-Soft Portfolio Gallery Responsive Image Gallery WordpressWordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Risk 77
Severity
8.8
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.

First published (updated )
CVE-2023-45629

WpDevArt Booking calendar, Appointment Booking SystemWordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability

Risk 79
Severity
8.8
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.3.

Remedy

Update the WordPress Booking calendar, Appointment Booking System plugin to the latest available version (at least 3.2.4).
First published (updated )
CVE-2023-24407

WpDevArt Booking calendar, Appointment Booking SystemWordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability

Risk 86
Severity
9.8
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.

Remedy

Update to 3.2.4 or a higher version.
First published (updated )
CVE-2023-24373

WpDevArt Organization Chart WordpressWordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Risk 77
Severity
8.8
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions.

1 / 2

Remedy

Update to 1.4.5 or a higher version.
First published (updated )
CVE-2023-24384

WpDevArt Organization Chart WordpressWordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Risk 40
Severity
5.9
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Organization chart plugin <= 1.4.4 versions.

1 / 2

Remedy

Update to 1.4.5 or a higher version.
First published (updated )
CVE-2023-24387

WpDevArt Download Image And Video Lightbox\, Image Popup WordpressWordPress Image and Video Lightbox, Image PopUp Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Risk 40
Severity
5.9
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Image and Video Lightbox, Image PopUp plugin <= 2.1.5 versions.

1 / 2

Remedy

Update to 2.1.6 or a higher version.
First published (updated )
CVE-2023-24004

WpDevArt Youtube Embed\, Playlist And Popup WordpressWordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Risk 40
Severity
5.9
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.3 versions.

1 / 2

Remedy

Update to 2.6.4 or a higher version.
First published (updated )
CVE-2023-24002

WpDevArt Responsive Vertical Icon Menu WordpressWordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF)

Risk 34
Severity
5.4
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.

1 / 2

Remedy

Update to 1.5.9 or a higher version.
First published (updated )
CVE-2023-23983

WpDevArt Social Like Box And Page WordpressWordPress Social Like Box and Page by WpDevArt Plugin <= 0.8.39 is vulnerable to Cross Site Scripting (XSS)

Risk 40
Severity
5.9
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39 versions.

1 / 2

Remedy

Update to 0.8.40 or a higher version.
First published (updated )
CVE-2023-23972

WpDevArt Responsive Vertical Icon Menu WordpressWordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)

Risk 40
Severity
5.9
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 versions.

1 / 2

Remedy

Update to 1.5.9 or a higher version.
First published (updated )
CVE-2023-23870

WpDevArt Image And Video Gallery With Thumbnails WordpressWordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1 versions.

1 / 2

Remedy

Update to 2.0.2 or a higher version.
First published (updated )
CVE-2022-47603

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203