CVE-2026-11882

The Builderall for WordPress plugin (pre-3.0.2) has an OAuth flaw where the state value from public OAuth routes is not bound to the initiating user session. This allows unauthenticated attackers to complete the OAuth connection flow and overwrite the stored third‑party integration access token. ...

CVE-2026-11882

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

PT-2026-23152

Name of the Vulnerable Software and Affected Versions Builderall Builder for WordPress versions through 3.0.1 Description The software contains a flaw related to improper control of code generation, potentially allowing code injection. The issue exists in Builderall Builder for WordPress...

CVE-2025-62987

CVE-2025-62987 corresponds to a Stored XSS in Builderall Builder for WordPress (builderall-cheetah-for-wp) via improper input neutralization. Affected: Builderall Builder for WordPress plugin up to version 3.0.1 (inclusive). Root cause: improper neutralization of input during web page generation....

PT-2025-43859

Name of the Vulnerable Software and Affected Versions Builderall Builder for WordPress versions through 3.0.1 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to a Stored Cross-site Scripting XSS condition. This allows for the injecti...