Kubio AI Page Builder <= 2.5.1 - Local File Inclusion

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubiohybridthemeloadtemplate function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...

CVE-2026-15234

The CVE-2026-15234 entry concerns the Codeless Page Builder plugin for WordPress (versions up to 1.1.4). It reports that the plugin does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, enabling stored XSS where users with contributor-leve...

CVE-2026-15234

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

CVE-2026-14921 Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

EUVD-2026-51418

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

CVE-2026-14921

The CVE covers the Ultimate Addons for WPBakery Page Builder WordPress plugin prior to version 3.21.5, where the shared link-rendering function Ultimate_VC_Addons::uavc_link_init() is implicated. This causes a stored XSS via the ult_buttons shortcode (as listed in CVE-Catalog/CVE records). Affect...

CVE-2026-15382

The CVE concerns the Ultimate Addons for WPBakery Page Builder WordPress plugin (before version 3.21.4). The vulnerability arises because there is no capability or nonce check when deleting a site’s custom-uploaded icon font packs, allowing an unauthenticated attacker to permanently delete all cu...

EUVD-2026-51001

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-15393

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and...

CVE-2026-65879

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-65766

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...

CVE-2026-65878

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...

CVE-2026-65876

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

CVE-2026-65877

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

CVE-2026-65876

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

CVE-2026-65876

CVE-2026-65876 affects the Joomla extension from joomshaper.com, specifically the SP Page Builder pre-6.7.1. The vulnerability arises from improper validation of catid parameters in the loadMoreArticles endpoint, yielding an unauthenticated SQL injection. The CVSS 4.0 vector indicates network acc...

CVE-2026-65876 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

EUVD-2026-49200

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

CVE-2026-65876 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

CVE-2026-65877 Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...