CVE-2026-11882

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882

Builderall for WordPress plugin prior to version 3.0.2 contains an OAuth state handling flaw: it does not bind the OAuth flow state to the initiating user session, enabling unauthenticated attackers to finish the connection flow and overwrite the stored third‑party integration access token. A dur...

PT-2026-23152

Name of the Vulnerable Software and Affected Versions Builderall Builder for WordPress versions through 3.0.1 Description The software contains a flaw related to improper control of code generation, potentially allowing code injection. The issue exists in Builderall Builder for WordPress...

CVE-2025-62987

CVE-2025-62987 corresponds to a Stored XSS in Builderall Builder for WordPress (builderall-cheetah-for-wp) via improper input neutralization. Affected: Builderall Builder for WordPress plugin up to version 3.0.1 (inclusive). Root cause: improper neutralization of input during web page generation....

PT-2025-43859

Name of the Vulnerable Software and Affected Versions Builderall Builder for WordPress versions through 3.0.1 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to a Stored Cross-site Scripting XSS condition. This allows for the injecti...