MAL-2025-6294 Malicious code in mini-builder (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c41b8a00db37ce8a635ead3b85abe8e193f7281d259c2f0b275747924aa8648 Any computer that has this package installed or running should be considered...

WordPress JetTabs Cross-Site Scripting Vulnerability

WordPress JetTabs is a plugin for Elementor page builder, mainly used to add stylish tabs and tabs functionality to WordPress websites, supports building rich content and customizing styles through Elementor widgets. WordPress JetTabs suffers from a cross-site scripting vulnerability that stems...

WordPress Bold Page Builder Cross-Site Scripting Vulnerability

WordPress Bold Page Builder is a free and open source page builder plugin that allows users to quickly create custom page layouts through a drag and drop interface without writing code. WordPress Bold Page Builder suffers from a cross-site scripting vulnerability that originates from improper inp...

WordPress HTML5 Radio Player-WPBakery Page Builder Addon Path Traversal Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A path traversal vulnerability exists in the WordPress HTML5 Radio Player-WPBakery Page Builder Addon, which stems from improperly restricted pathnames, and no detailed...

The vulnerability of the Kubernetes Image Builder software lies in its use of hard-coded credentials, which allows an attacker to gain access to the virtual machine.

The vulnerability of the Kubernetes Image Builder software lies in the use of strictly encrypted credentials. Exploiting this vulnerability could allow a malicious actor to gain access to the virtual machine remotely...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the lack of limitation on max inlining ids ...

Exploit for Server-Side Request Forgery in Fusion_Builder_Project Fusion_Builder

CVE-2022-1386 – Fusion Builder Example: bash python3...

PT-2025-30382 · Nutanix +1 · Kubernetes Image Builder Nutanix +1

Name of the Vulnerable Software and Affected Versions: Kubernetes Image Builder Nutanix affected versions not specified OVA providers affected versions not specified Description: VM images built with Kubernetes Image Builder Nutanix or OVA providers may use default credentials for Windows images ...

VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override

CVSS Rating High 7.5: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root acces...

PT-2025-30242 · WordPress · Gutentor – Gutenberg Blocks – Page Builder For Gutenberg Editor

Name of the Vulnerable Software and Affected Versions: Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress versions up to and including 3.4.8 Description: The Gutentor plugin is susceptible to Stored Cross-Site Scripting XSS due to insufficient input sanitization...

CVE-2025-49034

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through = 3.10.2...

CVE-2025-31070

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg-cleverbakery allows Path Traversal.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through = 2.5...

CVE-2025-54033

Cross-Site Request Forgery CSRF vulnerability in BlocksWP Theme Builder For Elementor theme-builder-for-elementor allows Cross Site Request Forgery.This issue affects Theme Builder For Elementor: from n/a through = 1.2.3...

CVE-2025-54006

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through = 5.4.1...

CVE-2025-6747

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusionmap' shortcode in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin WooCommerce Shop Page Builder versions = 2.27.7...

WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Theme Builder For Elementor versions = 1.2.3...

CVE-2025-49034

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through = 3.10.2...

CVE-2025-31070

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg-cleverbakery allows Path Traversal.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through = 2.5...

WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Multimedia Playlist Slider Addon for WPBakery Page Builder versions = 2.1...