CVE-2025-1280

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CVE-2025-1281

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2025-1280 BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CVE-2025-1280

BM Content Builder is a WordPress plugin affected by a Directory Traversal vulnerability in the ux_cb_page_customize_save_layout_ajax() function. All versions prior to 3.17.1 are impacted, allowing authenticated attackers with Subscriber-level privileges or higher to read arbitrary files on the s...

CVE-2025-1280 BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

EUVD-2025-210985

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CVE-2025-1281 BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2025-1281 BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2025-1281

CVE-2025-1281 affects the BM Content Builder WordPress plugin in all versions prior to 3.17.1 . The vulnerability stems from insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions, allowing an authenticated attacker with Subscriber-level access...

EUVD-2025-210983

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2025-1281: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2025-1280: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

PT-2026-96654

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside...

PT-2026-96655

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description Insufficient file path validation in the ux cb remove layout ajax and ux cb tools export ajax functions allows authenticated attackers with Subscriber-level access and above to delete...

CVE-2025-69055 WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through 3.16.3.3...

CVE-2025-69055 WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through 3.16.3.3...

CVE-2025-69055

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in SeaTheme BM Content Builder allows Path Traversal.This issue affects BM Content Builder: from n/a before 3.16.3.3...

CVE-2025-69055: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through 3.16.3.3...

WordPress plugin BM Content Builder has a path traversal vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Bonds in WordPress Plugin BM Content Builder versions 3.16.3.3...