Log in Start free

WPdevart

Products

ProductCVEsExploitedLatest
Booking calendar, Appointment Booking System14–Aug 18, 2026
Responsive Image Gallery, Gallery Album5–Jan 2, 2025
Organization chart4–May 25, 2026
Gallery – Image and Video Gallery with Thumbnails3–Oct 18, 2023
YouTube Embed, Playlist and Popup by WpDevArt2–Jul 3, 2025
Contact Form Builder, Contact Widget2–Jun 10, 2024
Countdown Timer – Widget Countdown2–Oct 14, 2026
Responsive Vertical Icon Menu2–Apr 4, 2023
Widget Countdown2–May 7, 2025
Image and Video Lightbox, Image PopUp1–Apr 6, 2023
Contact Form Builder1–May 10, 2026
Poll, Survey, Questionnaire and Voting system1–Jul 12, 2021
Poll, Survey, Questionnaire and Voting system (WordPress plugin)1–Sep 6, 2022
Pricing Table builder1–Oct 27, 2025
Coming soon and Maintenance mode1–Jun 4, 2024
Countdown and CountUp, WooCommerce Sales Timers1–Sep 28, 2021
Booking Calendar Pro WpDevArt1–Jan 7, 2025
Countdown and CountUp, WooCommerce Sales Timer1–Nov 14, 2023

Exploited and recent CVEs

  • CVE-2026-16495 Medium 6.4 Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute 0.2%
  • CVE-2026-73395 Medium 6.5 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability 0.3%
  • CVE-2026-8840 Medium 5.3 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action 0.5%
  • CVE-2026-57778 Medium 5.3 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability 0.3%
  • CVE-2026-15289 Medium 5.9 Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id' 0.4%
  • CVE-2026-24597 Medium 4.3 WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2022-50959 Medium 6.1 WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php 0.2%
  • CVE-2026-25435 High 7.1 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-14555 Medium 6.4 Countdown Timer - Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.2%
  • CVE-2025-67574 Medium 5.3 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability 0.3%
  • CVE-2025-62886 High 7.1 WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2025-2537 Medium 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library 0.3%
  • CVE-2025-47443 Medium 6.5 WordPress Widget Countdown plugin <= 2.7.4 - Cross Site Scripting (XSS) Vulnerability 0.3%
  • CVE-2025-24719 Medium 6.5 WordPress Widget Countdown plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-12077 Medium 6.1 Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' 0.4%
  • CVE-2024-12077 Medium 6.1 Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' 0.4%
  • CVE-2023-45631 Medium 4.3 WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability 0.4%
  • CVE-2024-10856 Medium 6.5 Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection 0.5%
  • CVE-2023-24407 Medium 5.0 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability 0.5%
  • CVE-2024-9504 High 7.2 Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload 0.5%
  • CVE-2024-7355 Medium 4.9 Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters 0.3%
  • CVE-2024-37542 Medium 5.4 WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability 0.2%
  • CVE-2024-35747 Medium 5.3 WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability 0.4%
  • CVE-2024-35750 High 8.5 WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - SQL Injection vulnerability 0.4%
  • CVE-2023-49741 Low 3.7 WordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerability 0.3%
  • CVE-2023-24373 Low 3.7 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability 0.4%
  • CVE-2024-30550 High 7.1 WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-31120 Medium 6.5 WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2023-47533 Medium 5.9 WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS) 0.4%
  • CVE-2022-47428 Medium 6.7 WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection 0.7%