CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925

The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...

CVE-2026-12227-visualcomposer-lfi-poc

CVE-2026-12227 - Laboratorio de validación de LFI no autenticado en Visual Composer mediante vcv-template Material de investigación de seguridad para reproducir y validar CVE-2026-12227 : una inclusión local de archivos no autenticada en la resolución de plantillas de página del Visual Composer...

CVE-2026-102002: Exposure of Sensitive Information to an Unauthorized Actor

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

PT-2026-104138

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed – Simple Social Feeds for WordPress versions prior to 4.13.1 Description Insufficient input sanitization and output escaping in the Admin Builder Preview allow unauthenticated attackers to perform Stored Cross-Si...

PT-2026-104116

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.9.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the comment...

PT-2026-104078

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description An issue exists in the Register & Login add-on where the before email success msg function, during the register login action='update' flow, trusts a user-supplied use...

PT-2026-104118

Name of the Vulnerable Software and Affected Versions Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 3.2.7 Description An issue exists that allows authenticated attackers with subscriber-level access and above to expose sensitive information. By utilizi...

PT-2026-104077

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

PT-2026-104080

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925: Improper Neutralization of Input During Web Page Generation

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100107: Improper Neutralization of Input During Web Page Generation

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - Restablecimiento de contraseña arbitrario sin autenticación CVE-2025-15030 User Profile Builder — Restablecimiento de contraseña sin autenticación → Toma de control de administrador + Subida de shell / / \ |/ / / / / / \ / / / \ / \ | / | | //|...

CVE-2023-6000

CVE-2023-6000 PoC ¿Cómo funciona este método de detección? Esta plantilla examina la siguiente ruta: /wp-content/plugins/popup-builder/readme.txt Según la etiqueta Stable Tag indicada, si la versión es anterior a 4.2.3, se considera vulnerable. ¿Cómo ejecuto este script? 1. Descarga Nuclei desde...

CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC

CVE-2024-25600 — WordPress Bricks Builder RCE PoC Vulnerabilidad de ejecución remota de código no autenticada en WordPress Bricks Builder id uid=33www-data gid=33www-data groups=33www-data Referencias CVE-2024-25600 Aviso de seguridad de Bricks Builder Artículo de Wordfence Créditos Descubrimient...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

SummaryThe dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

PYSEC-2026-4049 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

CVE-2026-102379

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

CVE-2026-102379 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

CVE-2026-102379

The BuildKit – Product Builder for WooCommerce – Custom PC Builder WordPress plugin (versions ≤ 1.0.28 ) is vulnerable to a Blind SQL Injection due to the improper neutralization of special elements used in an SQL command. This vulnerability, identified in the woo-product-builder component, allow...