Total-Soft

2 CVEs across 5 Total-Soft products. Browse Total-Soft vulnerabilities, severities, and proof-of-concept exploits.

Total-Soft products with known CVEs

ProductCVEs
Video Gallery4
Event Calendar3
Ts Poll2
Portfolio Gallery – Responsive Image Gallery1
Responsive Poll1
Total-Soft CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-8700High7.52025-05-15The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calend…
CVE-2023-32585High7.52024-12-13Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security…
CVE-2024-9769Medium4.42024-12-06The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to…
CVE-2024-10247High7.22024-12-06The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versi…
CVE-2024-8625High7.22024-10-21The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injectio…
CVE-2024-9022High7.22024-10-10The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to…
CVE-2023-45069High7.62023-11-06Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gallery – Best WordPres…
CVE-2023-25979Medium5.92023-05-03Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Video Gallery by Total-Soft Video Gallery plugin <= 1.7.6 versions.
CVE-2022-36390Medium4.12022-09-21Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
CVE-2022-38067Medium6.52022-09-09Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
CVE-2020-11673Critical9.82020-04-13An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view…