Webdevocean develops a focused portfolio of WordPress plugin extensions, including visual editors, gallery components, and page-builder integrations that extend authoring and design capabilities. Its vulnerability signal concentrates on application-layer input-handling and authorization weaknesses—cross-site scripting, missing authorization checks, cross-site request forgery, and PHP file-inclusion flaws—that are typical of plugin ecosystems where access controls and input validation depend on developer discipline across distributed codebases. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webdevocean over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-13592HIGH The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 't | Feb 19, 2025 | 8.8 | 25 | NO | NO |
CVE-2023-47552HIGH Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects – WordPress Plugin: from n/a through 5. | Nov 18, 2023 | 8.8 | 24 | NO | NO |
CVE-2021-4363MEDIUM The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and o | Jun 7, 2023 | 6.1 | 19 | NO | NO |
CVE-2022-4010MEDIUM The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross- | Dec 12, 2022 | 4.8 | 19 | NO | NO |
CVE-2021-4378MEDIUM The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and outp | Jun 7, 2023 | 5.4 | 18 | NO | NO |
CVE-2024-13751MEDIUM The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and including, 1.3 due to insufficient input | Feb 21, 2025 | 5.4 | 17 | NO | NO |
CVE-2024-13591MEDIUM The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'team-builder-vc' shortcode | Feb 19, 2025 | 5.4 | 17 | NO | NO |
CVE-2024-13582MEDIUM The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdo_simple_pricing | Feb 18, 2025 | 5.4 | 17 | NO | NO |
CVE-2024-30520MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Carousel Anything For WPBakery Page Builder allows Stored XSS.This | Mar 29, 2024 | 5.4 | 17 | NO | NO |
CVE-2021-4383MEDIUM The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plu | Jun 7, 2023 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webdevocean.
Media articles that mention a CVE ID that affects a product developed by Webdevocean — matched by CVE ID, not by vendor name.