CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder — неаутентифицированное локальное включение файлов LFI Краткое описание CVE-2026-12227 — критическая CVSS 9.8 неаутентифицированная уязвимость локального включения файлов LFI в плагине Visual Composer Website Builder для WordPress, затрагивающая все...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder — неаутентифицированное локальное включение файлов LFI Краткое описание CVE-2026-12227 — критическая CVSS 9.8 неаутентифицированная уязвимость локального включения файлов LFI в плагине Visual Composer Website Builder для WordPress, затрагивающая все...

WordPress Kubio AI Page Builder plugin <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Kubio AI Page Builder versions = 2.9.2...

cve-2025-22294

CVE-2025-2294 – Local File Inclusion LFI in WordPress Plugin Kubio AI Page Builder Link to detailed write-up Link to deployment Link to exploit Links to files for mass scanning: Template for active scan Template for passive scan Exploit for mass scanning in Python Exploit for mass scanning in...

CVE-2024-6366

To create a Metasploit module to exploit the RCE vulnerability in the User Profile Builder WordPress plugin before version 3.11.8, we need to take advantage of the lack of proper authorization in the media file upload functionality. Here is how you can create such a Metasploit module: Metasploit...

CVE-2026-92084

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2024-25600

Bricks Builder RCE Exploit CVE-2024-25600 This project contains a Python-based exploit script targeting the Bricks Builder WordPress plugin Remote Code Execution RCE vulnerability identified as CVE-2024-25600. The exploit allows unauthorized remote command execution by injecting PHP code via a...

CVE-2026-92084

The Beaver Builder Page Builder plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 2.11.0.5 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. This vulnerability c...

CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

EUVD-2026-91966

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

cve-2020-9006

CVE-2020-9006: Эксплойт для плагина Popup-Builder WordPress Использование: Create and upload payload Also see: php create-serialized-payload.php -h $ php create-serialized-payload.php | curl -F 'sprunge=-' http://sprunge.us http://sprunge.us/XXXXXX Run exploit $ nmap --script ./cve-2020-9006...

CVE-2026-88783

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-88783 Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-88783

The Kubio AI Page Builder WordPress plugin, in versions prior to 2.9.3 , is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to restrict the expansion of allowed HTML elements solely to the editor context; instead, the wider set of allowed ...

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin, in versions prior to 2.9.3 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a failure to validate the URI scheme of user-supplied values before they are output as link targets, specifically within the Image Gallery Item UR...

EUVD-2026-91941

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-88783 Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...