# cve.now: Wpdevart

The newest entries naming Wpdevart as an affected vendor (up to 200), of 44 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-16495](https://cve.now/CVE-2026-16495.md): Countdown Timer – Widget Countdown \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect\_url' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-73395](https://cve.now/CVE-2026-73395.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2026-8840](https://cve.now/CVE-2026-8840.md): Booking calendar, Appointment Booking System \<= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart\_payment AJAX Action (CVSS 5.3)
- [CVE-2026-57778](https://cve.now/CVE-2026-57778.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.36 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-15289](https://cve.now/CVE-2026-15289.md): Booking calendar, Appointment Booking System \<= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart\_id' (CVSS 5.9)
- [CVE-2026-24597](https://cve.now/CVE-2026-24597.md): WordPress Organization chart plugin \<= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2022-50959](https://cve.now/CVE-2022-50959.md): WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code\_generator.php (CVSS 5.1)
- [CVE-2026-25435](https://cve.now/CVE-2026-25435.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.36 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-14555](https://cve.now/CVE-2025-14555.md): Countdown Timer - Widget Countdown \<= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-67574](https://cve.now/CVE-2025-67574.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.30 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-62886](https://cve.now/CVE-2025-62886.md): WordPress Pricing Table builder plugin \<= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1)
- [CVE-2025-2537](https://cve.now/CVE-2025-2537.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library (CVSS 6.4)
- [CVE-2025-47443](https://cve.now/CVE-2025-47443.md): WordPress Widget Countdown plugin \<= 2.7.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-24719](https://cve.now/CVE-2025-24719.md): WordPress Widget Countdown plugin \<= 2.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-12077](https://cve.now/CVE-2024-12077.md): Booking Calendar and Booking Calendar Pro \<= Multiple Versions - Reflected Cross-Site Scripting via 'calendar\_id' (CVSS 6.1)
- [CVE-2023-45631](https://cve.now/CVE-2023-45631.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-10856](https://cve.now/CVE-2024-10856.md): Booking Calendar WpDevArt \<= 3.2.19 - Authenticated (Contributor+) SQL Injection (CVSS 6.5)
- [CVE-2023-24407](https://cve.now/CVE-2023-24407.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 5.0)
- [CVE-2024-9504](https://cve.now/CVE-2024-9504.md): Booking calendar, Appointment Booking System \<= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2)
- [CVE-2024-7355](https://cve.now/CVE-2024-7355.md): Organization chart \<= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title\_input and node\_description Parameters (CVSS 4.9)
- [CVE-2024-37542](https://cve.now/CVE-2024-37542.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-35747](https://cve.now/CVE-2024-35747.md): WordPress Contact Form Builder, Contact Widget plugin \<= 2.1.7 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2024-35750](https://cve.now/CVE-2024-35750.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2023-49741](https://cve.now/CVE-2023-49741.md): WordPress Coming soon and Maintenance mode plugin \<= 3.7.3 - IP Filtering Bypass vulnerability (CVSS 3.7)
- [CVE-2023-24373](https://cve.now/CVE-2023-24373.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.3 - Bypass vulnerability (CVSS 3.7)
- [CVE-2024-30550](https://cve.now/CVE-2024-30550.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-31120](https://cve.now/CVE-2024-31120.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-47533](https://cve.now/CVE-2023-47533.md): WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin \<= 1.8.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2022-47428](https://cve.now/CVE-2022-47428.md): WordPress Booking calendar, Appointment Booking System Plugin \<= 3.2.7 is vulnerable to SQL Injection (CVSS 6.7)
- [CVE-2023-46075](https://cve.now/CVE-2023-46075.md): WordPress Contact Form Builder, Contact Widget Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-45630](https://cve.now/CVE-2023-45630.md): WordPress Responsive Image Gallery, Gallery Album Plugin \<= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-45629](https://cve.now/CVE-2023-45629.md): WordPress Responsive Image Gallery, Gallery Album Plugin \<= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-24387](https://cve.now/CVE-2023-24387.md): WordPress Organization chart Plugin \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-24002](https://cve.now/CVE-2023-24002.md): WordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin \<= 2.6.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-24004](https://cve.now/CVE-2023-24004.md): WordPress Image and Video Lightbox, Image PopUp Plugin \<= 2.1.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-23870](https://cve.now/CVE-2023-23870.md): WordPress Responsive Vertical Icon Menu Plugin \<= 1.5.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2022-47603](https://cve.now/CVE-2022-47603.md): WordPress Responsive Image Gallery, Gallery Album Plugin \<= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2022-47438](https://cve.now/CVE-2022-47438.md): WordPress Booking calendar, Appointment Booking System Plugin \<= 3.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-23983](https://cve.now/CVE-2023-23983.md): WordPress Responsive Vertical Icon Menu Plugin \<= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-24384](https://cve.now/CVE-2023-24384.md): WordPress Organization chart Plugin \<= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-24388](https://cve.now/CVE-2023-24388.md): WordPress Booking calendar, Appointment Booking System Plugin \<= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2022-34656](https://cve.now/CVE-2022-34656.md): WordPress Poll, Survey, Questionnaire and Voting system plugin \<= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)
- [CVE-2021-34636](https://cve.now/CVE-2021-34636.md): Countdown and CountUp, WooCommerce Sales Timer \<= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8)
- [CVE-2021-24442](https://cve.now/CVE-2021-24442.md): Poll, Survey, Questionnaire and Voting system \< 1.5.3 - Unauthenticated Blind SQL Injection (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpdevart
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.