Devowl develops WordPress plugins focused on media management and consent handling, serving a modestly represented but prominent vendor position within the WordPress ecosystem. Its vulnerability profile centers on application-layer input and trust-boundary issues characteristic of web plugins, with recurring weaknesses in cross-site scripting, cross-site request forgery, and improper input validation affecting products such as Real Media Library and Real Cookie Banner. Current severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Devowl over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-0285MEDIUM The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform S | Feb 21, 2023 | 5.4 | 20 | NO | NO |
CVE-2022-4507MEDIUM The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow user | Jan 16, 2023 | 5.4 | 20 | NO | NO |
CVE-2024-2027MEDIUM The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all versions up to, and in | Apr 9, 2024 | 5.4 | 19 | NO | NO |
CVE-2021-34668MEDIUM The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows | Aug 30, 2021 | 5.4 | 19 | NO | NO |
CVE-2022-0445MEDIUM The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing att | Mar 7, 2022 | 6.5 | 17 | NO | NO |
CVE-2024-2328MEDIUM The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text in all versions up to | May 2, 2024 | 5.4 | 16 | NO | NO |
CVE-2025-1485MEDIUM The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its | Jun 2, 2025 | 4.8 | 15 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Devowl.
Media articles that mention a CVE ID that affects a product developed by Devowl — matched by CVE ID, not by vendor name.