PT-2025-21982 · Unknown · Visual Composer Website Builder

Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder versions through 45.11.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in Visual Composer Website...

PT-2025-22062 · Woocommerce · Choplugins Custom Pc Builder Lite

Name of the Vulnerable Software and Affected Versions: ChoPlugins Custom PC Builder Lite for WooCommerce versions 1.0.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels...

WordPress plugin Cost Calculator Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-22078 · Unknown · Smart Sections Theme Builder

Name of the Vulnerable Software and Affected Versions: Smart Sections Theme Builder - WPBakery Page Builder Addon versions 1.7.8 and earlier Description: The issue is related to the deserialization of untrusted data in the Smart Sections Theme Builder - WPBakery Page Builder Addon. This could...

CVE-2025-31921

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder WPUltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through = 1.055...

CVE-2025-3715

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-3715 Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-3715 Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-3715

CVE-2025-3715 affects the Bold Page Builder WordPress plugin up to and including 5.3.5, enabling a Stored Cross-Site Scripting (XSS) via the data-text parameter. Exploitation requires authenticated access at Contributor level or higher, and scripts run when a user views an injected page. Multiple...

WordPress plugin Bold Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-21830 · WordPress · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: The Bold Page Builder plugin for WordPress versions up to, and including, 5.3.5 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

CVE-2025-31915

Cross-Site Request Forgery CSRF vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through = 1.0.3...

CVE-2025-31921

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder WPUltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through = 1.055...

CVE-2025-31921 WordPress WP Ultimate Tours Builder <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder allows Cross Site Request Forgery. This issue affects WP Ultimate Tours Builder: from n/a through 1.055...

CVE-2025-31915 WordPress Pixel WordPress Form BuilderPlugin & Autoresponder <= 1.0.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder allows Cross Site Request Forgery. This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through 1.0.2...

CVE-2025-31915 WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through = 1.0.3...

CVE-2025-31921

CVE-2025-31921: CSRF vulnerability in WordPress WP Ultimate Tours Builder (versions &lt;= 1.055). Affects loopus WP Ultimate Tours Builder; CVSS v3.1 base score 4.3 (Medium). Root cause is CSRF allowing unauthorized actions on behalf of an authenticated user. Connected sources consistently refere...

CVE-2025-31921 WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder WPUltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through = 1.055...

WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Pixel WordPress Form BuilderPlugin & Autoresponder versions = 1.0.3...

CVE-2025-3201

The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks...