CVE-2026-95865: Improper Neutralization of Special Elements used in an SQL Command

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PT-2026-104552

Name of the Vulnerable Software and Affected Versions The Beaver Builder Page Builder – Drag and Drop Website Builder versions prior to 2.11.0.6 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the software fails to properly validate a value before...

PT-2026-104528

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 Description The plugin fails to restrict the expansion of allowed HTML elements to the editor context. Consequently, this expanded set of allowed elements is applied to content...

CVE-2026-88783: Improper Neutralization of Input During Web Page Generation

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

PT-2026-104486

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-92084: Improper Control of Generation of Code

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

PT-2026-104594

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template...

badger-builder

badger-builder badger-builder is an AI-assisted tool for generating dynamic Brute Ratel C4 profiles. Simply provide badger-builder a flavor for your desired profile and it will prompt OpenAI for fitting configurations. Listener/payload profile configs that are AI generated: C2 URIs Request/respon...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Samuele Santonicola in WordPress Plugin Beaver Builder versions = 2.11.0.5...

TryHack3M-Bricks-Heist

TryHack3M: Atraco de Bricks Exploit • Writeup • Desafío CTF Un repositorio completo que contiene un exploit personalizado y un writeup detallado para el desafío TryHack3M: Bricks Heist Inicio Rápido • Estructura del Repositorio • El Exploit • El Writeup • Aviso Legal Resumen Este repositorio...

CVE-2026-87930

🌐 Language / Dil 📌 Özet Joomla Multi-CVE Suite — 7 zafiyet modülü + x7-panel.php deploy CVE| Eklenti ---|--- CVE-2026-56291| Balbooa Forms combaforms CVE-2026-56290| Page Builder CK compagebuilderck CVE-2026-48908| SP Page Builder comsppagebuilder CVE-2026-48907| JCE comjce CVE-2026-48939| iCagen...

CVE-2026-48908

🌐 Language / Dil 📌 Özet SP Page Builder Joomla — Kimlik doğrulamasız ZIP yükleme → RCE | ---|--- Ürün| SP Page Builder — comsppagebuilder JoomShaper Sürüm| ≤ 6.6.1 Fixed| 6.6.2+ — upload artık admin ister Auth| Unauthenticated Vektör| POST …&task=asset.uploadCustomIcon Field| customicon icon-font...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Beaver Builder versions = 2.11.0.5...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Intrudify in WordPress Plugin Cost Calculator Builder versions = 4.0.17...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-100107

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-93756 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

EUVD-2026-91253

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-93756 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...