CVE-2026-73395WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 08/18/2026 Severity Medium CVE-2026-8840Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 08/15/2026 Severity Medium CVE-2026-57778WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 07/13/2026 Severity Medium CVE-2026-15289Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id' Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 07/10/2026 Severity Medium CVE-2026-24597WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product O Organization chart Published 05/25/2026 Severity Medium CVE-2022-50959WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php Exploitation status Public exploit Fix Not confirmed Affected product C Contact Form Builder Published 05/10/2026 Severity Medium CVE-2026-25435WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 03/25/2026 Severity High CVE-2025-14555Countdown Timer - Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product C Countdown Timer – Widget Countdown Published 01/10/2026 Severity Medium CVE-2025-67574WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 12/09/2025 Severity Medium CVE-2025-62886WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product P Pricing Table builder Published 10/27/2025 Severity High CVE-2025-2537Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library Exploitation status Not known exploited Fix Affected product Y YouTube Embed, Playlist and Popup by WpDevArt Published 07/03/2025 Severity Medium CVE-2025-47443WordPress Widget Countdown plugin <= 2.7.4 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product W Widget Countdown Published 05/07/2025 Severity Medium CVE-2025-24719WordPress Widget Countdown plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W Widget Countdown Published 01/24/2025 Severity Medium CVE-2024-12077Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 01/07/2025 Severity Medium CVE-2023-45631WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product R Responsive Image Gallery, Gallery Album Published 01/02/2025 Severity Medium CVE-2024-10856Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 12/24/2024 Severity Medium CVE-2023-24407WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 12/09/2024 Severity Medium CVE-2024-9504Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 11/26/2024 Severity High CVE-2024-7355Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters Exploitation status Not known exploited Fix Affected product O Organization chart Published 08/07/2024 Severity Medium CVE-2024-37542WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product R Responsive Image Gallery, Gallery Album Published 07/06/2024 Severity Medium CVE-2024-35747WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability Exploitation status Not known exploited Fix Affected product C Contact Form Builder, Contact Widget Published 06/10/2024 Severity Medium CVE-2024-35750WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product R Responsive Image Gallery, Gallery Album Published 06/08/2024 Severity High CVE-2023-49741WordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerability Exploitation status Not known exploited Fix Affected product C Coming soon and Maintenance mode Published 06/04/2024 Severity Low CVE-2023-24373WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 06/03/2024 Severity Low CVE-2024-30550WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product R Responsive Image Gallery, Gallery Album Published 03/31/2024 Severity High CVE-2024-31120WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product R Responsive Image Gallery, Gallery Album Published 03/31/2024 Severity Medium CVE-2023-47533WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product C Countdown and CountUp, WooCommerce Sales Timer Published 11/14/2023 Severity Medium CVE-2022-47428WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 11/06/2023 Severity Critical CVE-2023-46075WordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product C Contact Form Builder, Contact Widget Published 10/26/2023 Severity High CVE-2023-45630WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product G Gallery – Image and Video Gallery with Thumbnails Published 10/18/2023 Severity High CVE-2023-45629WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not confirmed Fix Affected product G Gallery – Image and Video Gallery with Thumbnails Published 10/16/2023 Severity Medium CVE-2023-0900AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi Exploitation status Public exploit Fix Not confirmed Affected product P Pricing Table Builder Published 06/05/2023 Severity High CVE-2023-24387WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product O Organization chart Published 04/06/2023 Severity Medium CVE-2023-24002WordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product Y YouTube Embed, Playlist and Popup by WpDevArt Published 04/06/2023 Severity Medium CVE-2023-24004WordPress Image and Video Lightbox, Image PopUp Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product I Image and Video Lightbox, Image PopUp Published 04/06/2023 Severity Medium CVE-2023-23972WordPress Social Like Box and Page by WpDevArt Plugin <= 0.8.39 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product S Social Like Box and Page by WpDevArt Published 04/06/2023 Severity Medium CVE-2023-23870WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product R Responsive Vertical Icon Menu Published 04/04/2023 Severity Medium CVE-2022-47603WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product G Gallery – Image and Video Gallery with Thumbnails Published 03/29/2023 Severity High CVE-2022-47438WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 03/29/2023 Severity Medium CVE-2023-23983WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product R Responsive Vertical Icon Menu Published 02/28/2023 Severity Medium CVE-2023-24384WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product O Organization chart Published 02/23/2023 Severity Medium CVE-2023-24388WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product B Booking calendar, Appointment Booking System Published 02/17/2023 Severity Medium CVE-2023-0177Social Like Box and Page by WpDevArt < 0.8.41 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product S Social Like Box and Page by WpDevArt Published 02/13/2023 Severity Medium CVE-2022-3982Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload Exploitation status Public exploit Fix Affected product B Booking calendar, Appointment Booking System Published 12/12/2022 Severity Critical CVE-2022-34656WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Not confirmed Affected product P Poll, Survey, Questionnaire and Voting system (WordPress plugin) Published 09/06/2022 Severity Medium CVE-2022-1946Gallery < 2.0.0 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product G Gallery – Image and Video Gallery with Thumbnails Published 07/04/2022 Severity Unknown CVE-2022-0876Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site Scripting Exploitation status Not confirmed Fix Affected product S Social comments by WpDevArt Published 04/25/2022 Severity Unknown CVE-2022-0640AP Pricing Tables Lite < 1.1.5 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product P Pricing Table Builder – AP Pricing Tables Lite Published 03/21/2022 Severity Unknown CVE-2022-0199Coming soon and Maintenance mode < 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRF Exploitation status Not confirmed Fix Affected product C Coming soon and Maintenance mode Published 02/21/2022 Severity Unknown CVE-2022-0164Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users Exploitation status Public exploit Fix Affected product C Coming soon and Maintenance mode Published 02/21/2022 Severity Unknown CVE-2021-25075Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS Exploitation status Not confirmed Fix Affected product D Duplicate Page or Post Published 02/21/2022 Severity Unknown CVE-2021-24577Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS Exploitation status Not confirmed Fix Affected product C Coming soon and Maintenance mode Published 10/11/2021 Severity Unknown CVE-2021-34636Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product C Countdown and CountUp, WooCommerce Sales Timers Published 09/28/2021 Severity High CVE-2021-24464YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS Exploitation status Not confirmed Fix Affected product Y YouTube Embed, Playlist and Popup by WpDevArt Published 08/02/2021 Severity Unknown CVE-2021-24442Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection Exploitation status Not confirmed Fix Affected product P Poll, Survey, Questionnaire and Voting system Published 07/12/2021 Severity Unknown CVE-2018-10363CVE-2018-10363 Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 06/13/2018 Severity Unknown CVE-2017-14125CVE-2017-14125 Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 09/25/2017 Severity Unknown 
.svg){kind=icon}
