12887 matches found
WordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Cút lộn xào me Patchstack Alliance in WordPress Theme Course Builder versions 3.6.6...
CVE-2025-5286
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additionalsettings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-5286 Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additionalsettings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-5286 Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additionalsettings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-5286
The CVE-2025-5286 entry concerns the WordPress Bold Page Builder plugin. Affected: Bold Page Builder plugin for WordPress ≤ 5.3.6. Issue: Stored Cross-Site Scripting via the additional_settings parameter due to insufficient input sanitization and output escaping. Impact: Authenticated attackers w...
course-builder 代码问题漏洞
course-builder is an open source application from Overdrive Eletrônica. A code issue vulnerability exists in course-builder versions prior to 3.6.6 that stems from deserializing untrusted data, which could lead to object injection...
WordPress Course Builder Theme < 3.6.6 is vulnerable to PHP Object Injection
Software Course Builder Type Theme Vulnerable versions 3.6.6 Fixed in 3.6.6 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-48336 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 330f3e0387ca Credits Annn Required privilege Unauthenticated...
WordPress plugin Bold Page Builder 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Bold Page Builder plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...
PT-2025-23145 · WordPress · Bold Page Builder
Name of the Vulnerable Software and Affected Versions: Bold Page Builder plugin for WordPress versions up to, and including, 5.3.6 Description: The issue is related to Stored Cross-Site Scripting via the additional settings parameter due to insufficient input sanitization and output escaping. Thi...
PT-2025-23196 · Thimpress · Thimpress Course Builder
Name of the Vulnerable Software and Affected Versions: ThimPress Course Builder versions prior to 3.6.6 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can be exploited due to the deserialization of untrusted data, potentially leading to...
WordPress SKT Page Builder plugin <= 4.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by RoyTdd in WordPress Plugin SKT Page Builder versions = 4.9...
CVE-2025-46488
Missing Authorization vulnerability in dastan800 Visual Builder visual-builder allows Reflected XSS.This issue affects Visual Builder: from n/a through = 1.2.2...
CVE-2025-31914
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through ...
Exploit for CVE-2025-2294
CVE-2025-2294 🚨 CVE-2025-2294 - Local File Inclusion LFI...
CVE-2025-4223 Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘loginurl’ parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress plugin Page Builder: Pagelayer 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2025-46488
Missing Authorization vulnerability in dastan800 Visual Builder visual-builder allows Reflected XSS.This issue affects Visual Builder: from n/a through = 1.2.2...
CVE-2025-31914
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through ...
CVE-2025-46488 WordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in dastan800 Visual Builder visual-builder allows Reflected XSS.This issue affects Visual Builder: from n/a through = 1.2.2...