CVE-2025-8488

The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savehfecompatibilityoptioncallback function in all versions up to, and including, 2.4.6. This makes it...

CVE-2025-3075

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-4370

The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on processexternalasseturls function as well as missing path validation in storefile function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated...

WordPress WPBakery Page Builder for WordPress Cross-Site Scripting Vulnerability

WordPress WPBakery Page Builder for WordPress is a powerful visual page builder plugin for the WordPress platform, providing an intuitive drag-and-drop interface and a wealth of preset templates, so that non-professional developers can quickly build responsive websites. WordPress WPBakery Page...

WordPress Supreme Addons for Beaver Builder Cross-Site Scripting Vulnerability

WordPress Supreme Addons for Beaver Builder is a plugin that extends the functionality of the Beaver Builder page builder, mainly for enhancing its visual editing capabilities and module extensions. A cross-site scripting vulnerability exists in WordPress Supreme Addons for Beaver Builder, which...

CVE-2025-4370

The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on processexternalasseturls function as well as missing path validation in storefile function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated...

CVE-2025-4370

The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on processexternalasseturls function as well as missing path validation in storefile function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated...

CVE-2025-4566

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element attribute in Text Path widget in all versions up to, and including, 3.30.2 due to insufficient input sanitization and output escaping. This...

CVE-2025-4370

CVE-2025-4370 reports a vulnerability in Brizy – Page Builder for WordPress (versions up to and including 2.6.20) where unauthenticated attackers can upload limited file types due to missing authorization in process_external_asset_urls and missing path validation in store_file. This leads to unin...

CVE-2025-4566

CVE-2025-4566 : Elementor Website Builder for WordPress is vulnerable to Stored XSS via the data-text attribute in the Text Path widget (Text Path). Affected: all versions up to 3.30.2. Exploitation requires authenticated access at Contributor level or higher; impact is script execution when a us...

CVE-2025-6495 Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter

The Bricks theme for WordPress is vulnerable to blind SQL Injection via the ‘p’ parameter in all versions up to, and including, 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticat...

CVE-2025-6495 Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter

The Bricks theme for WordPress is vulnerable to blind SQL Injection via the ‘p’ parameter in all versions up to, and including, 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticat...

WordPress plugin Elementor Website Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-31165 · WordPress · Brizy – Page Builder

Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to and including 2.6.20 Description: The Brizy – Page Builder plugin for WordPress is susceptible to limited file uploads due to missing authorization in the process external asset urls...

PT-2025-31166 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.30.3 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the data-text DOM elemen...

WordPress plugin Elementor Website Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-31164 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.29.1 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the elementor-element...

WordPress Elementor plugin <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Text Path Widget vulnerability discovered by Asaf Mozes in WordPress Plugin Elementor Website Builder versions = 3.30.2...

WordPress Bricks Builder plugin <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter vulnerability

Unauthenticated SQL Injection via p Parameter vulnerability discovered by Jamie Burchell in WordPress Theme Bricks Builder versions = 1.12.4...

Malicious Package

Overview mini-builder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...