Read the docs

wpdevart

Records58All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high14CVSS 7.0–8.9

Exploited now

wpdevart records in CISA KEV

No wpdevart vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Booking Calendar 8 records HIGH Gallery 7 records LOW Coming Soon And Maintenance Mode 3 records LOW Organization Chart 3 records LOW Countdown And Countup, Woocommerce Sales Timer 2 records MEDIUM Poll, Survey, Questionnaire And Voting System 2 records HIGH Pricing Table Builder 2 records HIGH Responsive Vertical Icon Menu 2 records LOW

Records

8 records in Booking Calendar · all components

TI-2022-03651 CVE-2022-3982 · GHSA-7v4v-c3pr-fgrq

Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload

Priority HIGH 82

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04809 Published 2022-12-12 Fixed in 3.2.2
TI-2022-23505 CVE-2022-47428 · GHSA-vp68-65xj-g24v

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appoin…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00681 Published 2023-11-06 No fix listed CWE-89
TI-2023-09995 CVE-2023-24373 · GHSA-x838-jxp7-m9m8

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability

Priority MEDIUM 42

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00354 Published 2024-06-03 No fix listed CWE-472
TI-2023-10029 CVE-2023-24407 · GHSA-vm52-xw7f-3537

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability

Priority LOW 39

Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Bookin…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00501 Published 2024-12-09 No fix listed CWE-862
TI-2024-10064 CVE-2024-10856 · GHSA-cq77-jhpm-mjmj

Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection

Priority LOW 29

The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escap…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00493 Published 2024-12-24 No fix listed CWE-89
Open these records in search →