12646 matches found
WordPress Avada (Fusion) Builder plugin <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value vulnerability
Unauthenticated Arbitrary File Deletion via Form Entry Value vulnerability discovered by daroo in WordPress Plugin Fusion Builder versions = 3.15.3...
Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin
On May 13th, 2026, we received a submission for a critical Unauthenticated Arbitrary File Deletion vulnerability in Avada Builder, a premium WordPress plugin with an estimated 1,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to delete arbitrary...
WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Fusion Builder versions = 3.15.4...
CVE-2026-56009
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bricksable for Bricks Builder allows Stored XSS. This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83...
CVE-2026-56009
CVE-2026-56009 : Stored XSS in Bricksable for Bricks Builder plugin for WordPress, affected versions from n/a through 1.6.83. Root cause: Improper Neutralization of Input During Web Page Generation. CVSS 3.1 base score 5.9 (MEDIUM); attack vector NETWORK, complexity LOW, privileges required HIGH,...
CVE-2026-56009
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bricksable for Bricks Builder allows Stored XSS. This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83...
EUVD-2026-37873
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bricksable for Bricks Builder allows Stored XSS. This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83...
VulnCheck KEV: CVE-2026-8713
The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the...
EUVD-2026-37715
Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...
EUVD-2026-37610
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
EUVD-2026-37608
Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...
EUVD-2026-37592
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
CVE-2026-54193
Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...
CVE-2026-54194
Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...
CVE-2026-45436
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
CVE-2026-42385
Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...
CVE-2026-40723
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
CVE-2026-54193 WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability
Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...