Web-Dorado
19 CVEs across 21 Web-Dorado products. Browse Web-Dorado vulnerabilities, severities, and proof-of-concept exploits.
Web-Dorado products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25734 | Medium | 4.0 | 2026-06-04 | Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to inclu… |
CVE-2018-25347 | High | 7.1 | 2026-05-23 | WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through th… |
CVE-2023-2655 | High | 7.2 | 2024-01-16 | The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-48320 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderVPlayer allows Stored XSS.This issue affe… |
CVE-2023-5048 | Medium | 6.4 | 2023-11-22 | The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and incl… |
CVE-2023-46619 | Medium | 5.4 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions. |
CVE-2023-5709 | High | 8.8 | 2023-11-07 | The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient… |
CVE-2023-46090 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions. |
CVE-2023-45632 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions. |
CVE-2021-24625 | High | 7.2 | 2021-11-08 | The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them… |
CVE-2021-24426 | Medium | 4.8 | 2021-07-12 | The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the… |
CVE-2019-11591 | High | 8.8 | 2019-04-29 | The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion… |
CVE-2019-11557 | High | 8.8 | 2019-04-26 | The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file i… |
CVE-2018-16164 | Medium | 5.4 | 2019-01-09 | Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML… |
CVE-2018-10504 | High | 7.8 | 2018-04-27 | The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. |
CVE-2018-10301 | Medium | 6.1 | 2018-04-23 | Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitr… |
CVE-2018-10300 | Medium | 6.1 | 2018-04-23 | Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web… |
CVE-2018-5991 | Critical | 9.8 | 2018-02-17 | SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than C… |
CVE-2018-5981 | Critical | 9.8 | 2018-02-17 | SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter. |
CVE-2015-2798 | Critical | 9.8 | 2017-07-25 | SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
CVE-2017-2224 | Medium | 6.1 | 2017-07-07 | Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified… |
CVE-2017-7719 | Critical | 9.8 | 2017-04-12 | SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calenda… |
CVE-2015-4352 | | 2015-06-15 | Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administra… | |
CVE-2015-4351 | | 2015-06-15 | The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary… | |
CVE-2015-4350 | | 2015-06-15 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of admin… | |
CVE-2015-2562 | | 2015-03-20 | Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary… | |
CVE-2015-2196 | | 2015-03-03 | SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in… | |
CVE-2015-1582 | | 2015-02-11 | Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary we… | |
CVE-2014-8584 | | 2014-11-04 | Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote att… |