1149 matches found
CVE-2022-1329
CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...
Visual Composer <= 45.16.0 - Unauthenticated LFI
Visual Composer Website Builder for WordPress = 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication. id: CVE-2026-12227 info:...
CVE-2026-62062
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-62062 CVE-2026-62062 Elementor Website Builder 4.3.1 - Elementor I am @abraxasnull. Loopback lab. The client is CVE-2026-62062-Abraxas-Labs.py. CSRF via a substring. Elementor 4.3.0-4.3.1 skips WordPress REST...
CVE-2026-12227
CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...
CVE-2026-12227
CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...
CVE-2026-84925
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
EUVD-2026-91174
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-84925
The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...
CVE-2026-12227-visualcomposer-lfi-poc
CVE-2026-12227 - Visual Composer Unauthenticated LFI via vcv-template Validation Lab Security-research material for reproducing and validating CVE-2026-12227 : an unauthenticated local file inclusion in Visual Composer Website Builder's page-template resolution CVSS 3.1 9.8, plus a verified...
PT-2026-104080
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-12227
CVE-2026-12227 — Visual Composer Website Builder Unauthenticated LFI Python 3 PoC for CVE-2026-12227 Wordfence: Local File Inclusion via the vcv-template query parameter in Visual Composer Website Builder visualcomposer on wordpress.org. | ---|--- Platform| WordPress plugin Component| Visual...
Exploit for CVE-2026-12227
CVE-2026-12227: Visual Composer Website Builder Unauthenticated...
CVE-2026-97262
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...
EUVD-2026-89917
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...
CVE-2026-97262 WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...
CVE-2026-97262 WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...
CVE-2026-97262
The Visual Composer Website Builder plugin for WordPress (versions
WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Visual Composer Website Builder versions = 45.16.2...
