CVE-2026-15796

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bgvideoserviceurl' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15796

The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.0.2 , caused by insufficient input sanitization and output escaping in the bg_video_service_url setting. An authenticated attacker with Contributor-level access or higher can inj...