EUVD-2026-76785

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 is vulnerable to Stored XSS via a missing CSRF check on its template-import feature. Because the plugin does not sanitise imported data before storing and echoing it back, an attacker can craft a forged request that tricks a...

EVCer

EVCer | CVE-2023-0159 - 用于WPBakery页面构建器的Extensive VC附加组件 自动批量检测CVE-2023-0159漏洞的工具 - 适用于WPBakery页面构建器 install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 使用方法 bash evcer.sh yourlist.txt thread 参考 https://vulners.com/cve/CVE-2023-0159...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla 未认证远程代码执行 针对 CVE-2026-48908 的概念验证漏洞利用程序，这是一个严重（CVSS 4.0 = 10.0 ）的未经认证的远程代码执行漏洞，存在于 JoomShaper 开发的 Joomla SP Page Builder 组件 comsppagebuilder 中。 | ---|--- CVE| CVE-2026-48908 弱点| CWE-284 不正确的访问控制 → 未经认证的任意文件上传 → RCE 组件| SP Page Builder comsppagebuilder for...

Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload

Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56290 info: name: Page Builder CK = 3.5.10 - Unauthenticated Arbitrary File Uplo...

CVE-2026-62110

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

EUVD-2026-76210

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

CVE-2026-62110 WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

CVE-2026-62110

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

CVE-2025-2294

Kubio Page Builder LFI 漏洞利用工具 CVE-2025-2294 Kubio Page Builder WordPress 插件（版本 ≤ 2.5.1）的本地文件包含（LFI）漏洞利用工具。 📌 说明 该工具利用了 Kubio Page Builder 插件中的一个未授权 LFI 漏洞（CVE-2025-2294），允许攻击者读取易受攻击的 WordPress 站点上的敏感文件。 🚀 特性 单目标模式 -u 从文件批量扫描 -l 版本检测 将结果输出到文件 -o 自动检测易受攻击的版本 支持自定义文件路径 📦 安装 root@kitploit: git clone...

CVE-2025-2294

CVE-2025-4403 漏洞利用 详细信息 发布日期 ：2025年3月27日 更新日期 ：2025年3月28日 严重性 ：严重（CVSS 评分：9.8） CWE ：CWE-22：CWE-22 对受限目录的路径名限制不当（'路径遍历'） 受影响版本 ：从 n/a 到 2.5.1 的所有版本 研究人员 ：https://www.wordfence.com/threat-intel/vulnerabilities/researchers/michael-mazzolini CVSS 向量 CVSS 版本 ：9.8 向量字符串...

WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LevinityCyber in WordPress Plugin Bold Page Builder versions = 5.9.9...

CVE-2026-48908-SP-Page-Builder-Joomla

CVE-2026-48908: SP Page Builder Joomla 未授权远程代码执行 CVE-2026-48908 漏洞的利用验证（PoC）代码，针对 Joomla SP Page Builder 组件的未授权远程代码执行漏洞。 漏洞概述 CVE-2026-48908 是一个严重安全漏洞，允许未授权的攻击者在易受攻击的 Joomla 安装上通过 SP Page Builder 组件对 ZIP 文件提取的处理不当来执行任意代码。 技术细节 CVE ID： CVE-2026-48908 组件： comsppagebuilder 受影响版本： = 6.6.1 修复版本： 6.6.2...

CVE-2026-78374

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78374

T4 Page Builder (by joomlart.com) for Joomla, versions prior to 2.3.0 , is vulnerable to an open mail relay via its front-end JSON editor endpoint. The exposed contact action requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled), and has no rate limiting. An at...

EUVD-2026-75386

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

Kubio AI Page Builder <= 2.5.1 - Local File Inclusion

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubiohybridthemeloadtemplate function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...

CVE-2026-48908-by-yora

🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...