Wow-Company
29 CVEs across 42 Wow-Company products. Browse Wow-Company vulnerabilities, severities, and proof-of-concept exploits.
Wow-Company products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-20245 | High | 8.2 | 2026-06-09 | Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploit… |
CVE-2017-20244 | High | 8.2 | 2026-06-09 | Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by… |
CVE-2025-53258 | High | 7.6 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wow-Company Hover Effects hover-effects allows SQL Inject… |
CVE-2025-30912 | Medium | 5.4 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Float menu float-menu allows Cross Site Request Forgery.This issue affects Float menu: from n/a… |
CVE-2024-13901 | Medium | 4.4 | 2025-03-01 | The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting… |
CVE-2025-26760 | High | 7.5 | 2025-02-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder calcula… |
CVE-2025-0897 | Medium | 6.4 | 2025-02-20 | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all ve… |
CVE-2025-24699 | High | 7.1 | 2025-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a throug… |
CVE-2025-24724 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite side-menu-lite allows Cross Site Request Forgery.This issue affects Side Menu Lit… |
CVE-2025-24720 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Button… |
CVE-2025-24717 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: fro… |
CVE-2025-24716 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Herd Effects mwp-herd-effect allows Cross Site Request Forgery.This issue affects Herd Effects… |
CVE-2025-24715 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n… |
CVE-2025-24714 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affe… |
CVE-2025-24713 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.Thi… |
CVE-2025-24711 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Popup Box popup-box allows Cross Site Request Forgery.This issue affects Popup Box: from n/a thr… |
CVE-2023-49154 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Wow-Company Button Generator – easily Button Builder allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2024-6926 | Critical | 9.8 | 2024-09-04 | The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action availabl… |
CVE-2024-6927 | Medium | 4.8 | 2024-08-29 | The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-43346 | Medium | 6.5 | 2024-08-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This is… |
CVE-2024-35634 | Medium | 4.9 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wow-Company Woocommerce – Recent Purchases allows PHP Local Fil… |
CVE-2024-35629 | Critical | 9.6 | 2024-06-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – R… |
CVE-2024-3481 | Medium | 5.2 | 2024-05-02 | The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unw… |
CVE-2024-3478 | Medium | 6.1 | 2024-05-02 | The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform un… |
CVE-2024-3477 | Medium | 4.3 | 2024-05-02 | The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwan… |
CVE-2024-3476 | High | 8.8 | 2024-05-02 | The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2024-3475 | High | 7.5 | 2024-05-02 | The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2024-3474 | High | 8.8 | 2024-05-02 | The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perfor… |
CVE-2024-3472 | Medium | 5.9 | 2024-05-02 | The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in a… |
CVE-2024-3471 | Low | 3.4 | 2024-05-02 | The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin d… |
CVE-2024-2405 | Medium | 4.5 | 2024-05-02 | The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrar… |
CVE-2024-2457 | Medium | 6.4 | 2024-04-09 | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up… |
CVE-2024-2578 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP… |
CVE-2024-0703 | Medium | 4.4 | 2024-01-23 | The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and incl… |
CVE-2023-52149 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0. |
CVE-2023-49155 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Bui… |
CVE-2023-27418 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite – add sticky fixed buttons plugin <= 4.0 versions. |
CVE-2023-5161 | Medium | 6.4 | 2023-09-27 | The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient i… |
CVE-2023-4318 | Medium | 4.3 | 2023-09-11 | The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrar… |
CVE-2023-4022 | Medium | 4.8 | 2023-09-11 | The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2023-3650 | Medium | 4.8 | 2023-08-07 | The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perfor… |
CVE-2023-25443 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.5 versions. |
CVE-2023-3225 | Medium | 4.8 | 2023-07-10 | The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-27452 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions. |
CVE-2023-2362 | Medium | 6.1 | 2023-06-12 | The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder Wor… |
CVE-2023-23984 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion. |
CVE-2023-0895 | High | 7.2 | 2023-02-17 | The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and in… |
CVE-2022-2388 | Medium | 6.5 | 2022-08-22 | The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a lo… |
CVE-2022-2245 | High | 8.8 | 2022-08-01 | The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in… |
CVE-2022-29447 | Medium | 6.8 | 2022-05-20 | Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress. |
CVE-2022-29448 | Medium | 6.8 | 2022-05-20 | Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. |
CVE-2022-29446 | Medium | 6.8 | 2022-05-19 | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress. |
CVE-2022-29445 | Medium | 6.8 | 2022-05-18 | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress. |
CVE-2021-25064 | High | 7.2 | 2022-03-28 | The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authentic… |
CVE-2021-25054 | High | 8.8 | 2022-01-10 | The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL I… |
CVE-2021-25053 | High | 8.8 | 2022-01-10 | The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:/… |
CVE-2021-25052 | High | 8.8 | 2022-01-10 | The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as wit… |
CVE-2021-25051 | High | 8.8 | 2022-01-10 | The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with da… |
CVE-2021-24628 | High | 7.2 | 2021-11-08 | The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the… |