123 matches found
CVE-2026-14900
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...
EUVD-2026-50268
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...
CVE-2026-14900
The CVE-2026-14900 entry concerns the WordPress plugin Cost Calculator Builder PRO (versions up to 4.0.3). The root cause is insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside the js_to_php(...
EUVD-2026-48165
Unauthenticated Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.7 versions...
CVE-2026-57374
CVE-2026-57374 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Funnel Kit Funnel Builder PRO plugin, versioned <= 3.15.0.7. The CVSS v3.1 base score is 7.1 (HIGH) with NETWORK attack vector, LOW impacts to confidentiality/integrity/availability, and user ...
EUVD-2026-48164
Customer Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.4 versions...
CVE-2026-57373
CVE-2026-57373 affects WordPress Funnel Kit Funnel Builder PRO plugin, versions
EUVD-2026-46063
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...
CVE-2026-60031
The vulnerability CVE-2026-60031 affects the Joomla extension Quix Page Builder Pro (prior to version 6.2.1). The issue is an information disclosure resulting from raw exceptions being reflected in AJAX handler responses, enabling leakage of potentially sensitive data. Local context: affected com...
CVE-2026-60029 Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1
Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users...
CVE-2026-60029
Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users...
EUVD-2026-46058
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got executed via view-cache include. Requires caching on default...
CVE-2026-60026 Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1
Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...
EUVD-2026-46056
The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...
CVE-2026-58078
Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection...
WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.7...
WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Austin Ginder in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.4...
EUVD-2026-37608
Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...