CVE-2025-22759

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Stored XSS.This issue affects Post and Page Builder by BoldGrid: from n/a through = 1.27.5...

CVE-2025-22788 WordPress CoDesigner plugin <= 4.29 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codexpert, Inc CoDesigner woolementor allows Stored XSS.This issue affects CoDesigner: from n/a through = 4.29...

CVE-2024-12593 PDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode

The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdfdotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ApplyOnline versions = 2.6.7.1...

WordPress plugin PDF for WPForms + Drag and Drop Template Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress plugin CoDesigner WooCommerce Builder for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-12240

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12240 Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12240

CVE-2024-12240 is a Stored XSS vulnerability in Page Builder by SiteOrigin for WordPress, affecting all versions up to 2.31.0. The issue arises from insufficient input sanitization and output escaping in the row label parameter, enabling authenticated attackers with Contributor+ rights to inject ...

WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Post and Page Builder by BoldGrid versions = 1.27.5...

PT-2025-1789 · Siteorigin · The Page Builder By Siteorigin

Name of the Vulnerable Software and Affected Versions: The Page Builder by SiteOrigin plugin for WordPress versions up to, and including, 2.31.0 Description: The issue is related to Stored Cross-Site Scripting via the row label parameter due to insufficient input sanitization and output escaping...

WordPress Page Builder by SiteOrigin plugin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Row Label Parameter vulnerability discovered by zer0gh0st in WordPress Plugin Page Builder by SiteOrigin versions = 2.31.0...

CVE-2024-12304

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

WordPress plugin AI Scribe SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin AI...

CVE-2025-22810

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Phi Phan Content Blocks Builder content-blocks-builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through = 2.7.6...

CVE-2025-22810

CVE-2025-22810 affects Content Blocks Builder (WordPress) up to version 2.7.6. It is a Stored XSS in web page generation due to Improper Neutralization of Input During Web Page Generation. Patch released in 2.7.6 (Patched). CVSS v3.1 base score 6.5 (Medium). References include Patchstack entry; e...

CVE-2025-22810 WordPress Content Blocks Builder plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CBB Team Content Blocks Builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through 2.7.6...

CVE-2024-12848 SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...

CVE-2024-12848 SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...

CVE-2024-12848

CVE-2024-12848 concerns the SKT Page Builder plugin for WordPress. The vulnerability allows authenticated users with subscriber-level access or higher to upload arbitrary files due to a missing authorization check in the addLibraryByArchive function across all versions up to 4.6, enabling potenti...