wpdevart Vulnerabilities and Affected Products
Vulnerabilities associated with Contact Form Builder.
Products
Clear product- Booking calendar, Appointment Booking System12 vulnerabilities
- Responsive Image Gallery, Gallery Album5 vulnerabilities
- Organization chart4 vulnerabilities
- booking_calendar3 vulnerabilities
- Gallery – Image and Video Gallery with Thumbnails3 vulnerabilities
- Contact Form Builder, Contact Widget2 vulnerabilities
- Responsive Vertical Icon Menu2 vulnerabilities
- Widget Countdown2 vulnerabilities
- YouTube Embed, Playlist and Popup by WpDevArt2 vulnerabilities
- Booking Calendar Pro WpDevArt1 vulnerability
- Coming soon and Maintenance mode1 vulnerability
- Contact Form Builder1 vulnerability
- Countdown and CountUp, WooCommerce Sales Timer1 vulnerability
- Countdown and CountUp, WooCommerce Sales Timers1 vulnerability
- Countdown Timer – Widget Countdown1 vulnerability
- Image and Video Lightbox, Image PopUp1 vulnerability
- Poll, Survey, Questionnaire and Voting system1 vulnerability
- Poll, Survey, Questionnaire and Voting system (WordPress plugin)1 vulnerability
- poll\,_survey\,_questionnaire_and_voting_system1 vulnerability
- Pricing Table builder1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-50959MEDIUM | WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.phpWordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the form_id parameter. Attackers can craft malicious URLs to code_generator.php with script payloads in the form_id parameter to execute arbitrary JavaScript in victim browsers. CWE-79May 10, 2026 | CVSS5.1v4.0 | EPSS0.208% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |