PT-2026-67074

Name of the Vulnerable Software and Affected Versions Nex Forms – Ultimate Form Builder – Lite versions prior to 9.2.4 Description An arbitrary file deletion issue exists due to path traversal. The delete file AJAX handler retrieves a file path from the database and passes it to the unlink functi...

CVE-2026-67311: Server-Side Request Forgery (SSRF)

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

CVE-2026-15450: Improper Limitation of a Pathname to a Restricted Directory

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

CVE-2026-15234: Improper Neutralization of Input During Web Page Generation

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

PT-2026-67063

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

CVE-2026-15950: Improper Neutralization of Input During Web Page Generation

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization an...

CVE-2026-15601: Improper Limitation of a Pathname to a Restricted Directory

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.8.1...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.8...

CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-13392

The ElementsKit Elementor Addons WordPress plugin (versions before 3.10.01 ) is vulnerable to PHP Code Injection because it fails to sanitize custom-widget definitions saved by users with administrative privileges. These definitions are written verbatim into a generated PHP file that the plugin s...

CVE-2026-13392 ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-14921

The Ultimate Addons for WPBakery Page Builder WordPress plugin, in versions prior to 3.21.5 , is vulnerable to Stored XSS . The flaw originates from the shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(), and can be triggered via the ult_buttons shortcode. This vulnerability spe...

CVE-2026-14921 Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

CVE-2026-14921

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

EUVD-2026-51418

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-63221

CodeIgniter (PHP) 4.x contains a SQL injection in the Query Builder deleteBatch() path from 4.3.0–4.7.3. When used with where() conditions, deleteBatch() substitutes bound values into generated SQL and ignores escape flags, allowing user-controlled values to be interpreted as SQL. The issue does ...

CVE-2026-14921: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...