UBUNTU-CVE-2026-102580

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-102580

A flaw in Moodle allows an authenticated attacker to supply an improperly validated audience class name to the Report Builder component. This leads to arbitrary class instantiation , enabling the unauthorized creation of internal program objects. This vulnerability may result in unexpected applic...

CVE-2026-102580 Moodle: arbitrary class instantiation via report builder audience classname

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-102580 Moodle: arbitrary class instantiation via report builder audience classname

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

EUVD-2026-89719

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-102580 Moodle: arbitrary class instantiation via report builder audience classname

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-88037

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the btbbservice shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2026-6170

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's btbbcssimagegrid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This...

CVE-2026-6171

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's btbbicon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

CVE-2026-6172

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's btbbimage shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

CVE-2026-6173

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backgroundimage' parameter of the plugin's btbbsection shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

CVE-2026-6173

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.7.2 . The flaw exists in the bt_bb_section shortcode due to insufficient input sanitization and output escaping of the background_image parameter. An authenticated a...

EUVD-2026-89672

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backgroundimage' parameter of the plugin's btbbsection shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

CVE-2026-6173 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backgroundimage' parameter of the plugin's btbbsection shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

CVE-2026-6173 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backgroundimage' parameter of the plugin's btbbsection shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

CVE-2026-6170

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.7.2 . The root cause is insufficient input sanitization and output escaping of user-supplied attributes within the images parameter of the bt_bb_css_image_grid short...

CVE-2026-6171

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.7.2 . The root cause is insufficient input sanitization and output escaping on the 'target' parameter of the plugin's bt_bb_icon shortcode. This flaw allows authenti...

CVE-2026-6170 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's btbbcssimagegrid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This...

CVE-2026-6171 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's btbbicon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

EUVD-2026-89670

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's btbbcssimagegrid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This...