CVE-2026-88782: Improper Neutralization of Input During Web Page Generation

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-95865: Improper Neutralization of Special Elements used in an SQL Command

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PT-2026-104552

Name of the Vulnerable Software and Affected Versions The Beaver Builder Page Builder – Drag and Drop Website Builder versions prior to 2.11.0.6 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the software fails to properly validate a value before...

PT-2026-104528

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 Description The plugin fails to restrict the expansion of allowed HTML elements to the editor context. Consequently, this expanded set of allowed elements is applied to content...

CVE-2026-88783: Improper Neutralization of Input During Web Page Generation

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

PT-2026-104486

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-92084: Improper Control of Generation of Code

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

PT-2026-104594

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template...

badger-builder

badger-builder badger-builder 是一个用于生成动态 Brute Ratel C4 配置文件的 AI 辅助工具。只需为 badger-builder 提供一个你所需配置文件的 风格（flavor） ，它就会向 OpenAI 提示以获取合适的配置。 由 AI 生成的监听器/载荷配置文件： C2 URI 请求/响应 HTTP 头部 附加在 C2 请求/响应之前和之后的 HTTP 正文数据 服务器的 空响应 HTTP 正文 HTTP 正文数据可以以 XML、JSON 或 JavaScript 生成（并且请求格式可以与响应格式不同）。 我始终建议检查 OpenAI...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Samuele Santonicola in WordPress Plugin Beaver Builder versions = 2.11.0.5...

TryHack3M-Bricks-Heist

TryHack3M: Bricks Heist エクスプロイト • ライトアップ • CTFチャレンジ TryHack3M: Bricks Heistチャレンジのカスタムエクスプロイトと詳細なライトアップを含む包括的なリポジトリ クイックスタート • リポジトリ構造 • エクスプロイト • ライトアップ • 免責事項 概要 このリポジトリは、TryHack3M: Bricks Heist チャレンジ（中程度の難易度のCTFルーム）を文書化したものです： フェーズ| 説明 ---|--- 偵察| Bricks Builderを使用した脆弱なWordPressサイトの発見 エクスプロイト|...

CVE-2026-87930

🌐 语言 / Dil 📌 概述 Joomla Multi-CVE Suite — 7 个漏洞模块 + x7-panel.php 部署 CVE| 扩展 ---|--- CVE-2026-56291| Balbooa Forms combaforms CVE-2026-56290| Page Builder CK compagebuilderck CVE-2026-48908| SP Page Builder comsppagebuilder CVE-2026-48907| JCE comjce CVE-2026-48939| iCagenda comicagenda...

CVE-2026-48908

🌐 Language / Dil 📌 Özet SP Page Builder Joomla — Kimlik doğrulamasız ZIP yükleme → RCE | ---|--- Ürün| SP Page Builder — comsppagebuilder JoomShaper Sürüm| ≤ 6.6.1 Fixed| 6.6.2+ — upload artık admin ister Auth| Unauthenticated Vektör| POST …&task=asset.uploadCustomIcon Field| customicon icon-font...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Beaver Builder versions = 2.11.0.5...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Intrudify in WordPress Plugin Cost Calculator Builder versions = 4.0.17...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-100107

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-93756 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

EUVD-2026-91253

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...