| CVE-2025-50008 | WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability | cscode | WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily | Medium | 5.4 | 2025-06-20 15:04:05 | Deep Dive |
| CVE-2025-50034 | WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability | Mahmudul Hasan Arif | Enhanced Blocks – Page Builder Blocks for Gutenberg | Medium | 6.5 | 2025-06-20 15:03:54 | Deep Dive |
| CVE-2025-52713 | WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability | BoldGrid | Post and Page Builder by BoldGrid | Medium | 6.4 | 2025-06-20 15:03:36 | Deep Dive |
| CVE-2025-52711 | WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability | BoldGrid | Post and Page Builder by BoldGrid | Medium | 4.3 | 2025-06-20 15:03:36 | Deep Dive |
| CVE-2025-4965 | WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder | wpbakery | WPBakery Page Builder | Medium | 6.4 | 2025-06-19 06:44:49 | Deep Dive |
| CVE-2025-6062 | Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update | netlatch | Yougler Blogger Profile Page | Medium | 4.3 | 2025-06-14 08:23:26 | Deep Dive |
| CVE-2025-5123 | Contact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter | a3rev | Contact Us Page – Contact People | Medium | 6.4 | 2025-06-13 01:47:50 | Deep Dive |
| CVE-2025-31052 | WordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability | themeton | The Fashion - Model Agency One Page Beauty Theme | Critical | 9.8 | 2025-06-09 15:56:46 | Deep Dive |
| CVE-2025-30951 | WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.36 - Cross Site Scripting (XSS) Vulnerability | Stiofan | BlockStrap Page Builder - Bootstrap Blocks | Medium | 6.5 | 2025-06-06 12:54:12 | Deep Dive |
| CVE-2025-49322 | WordPress 404 Page by SeedProd plugin < 1.0.2 - Cross Site Scripting (XSS) Vulnerability | SeedProd | 404 Page by SeedProd | Medium | 5.9 | 2025-06-06 12:53:54 | Deep Dive |
| CVE-2025-49317 | WordPress WP Page Loading plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) Vulnerability | NTC | WP Page Loading | Medium | 4.3 | 2025-06-06 12:53:53 | Deep Dive |
| CVE-2025-49076 | WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.2.7 - Cross Site Scripting (XSS) vulnerability | POSIMYTH | The Plus Addons for Elementor Page Builder Lite | Medium | 6.5 | 2025-06-06 11:36:40 | Deep Dive |
| CVE-2025-4672 | Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function | offsprout | Offsprout Page Builder | High | 8.8 | 2025-05-31 06:40:56 | Deep Dive |
| CVE-2025-5142 | Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters | pluginsandsnippets | Simple Page Access Restriction | Medium | 6.5 | 2025-05-30 09:22:07 | Deep Dive |
| CVE-2025-5286 | Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter | boldthemes | Bold Page Builder | Medium | 6.4 | 2025-05-29 08:22:04 | Deep Dive |
| CVE-2025-4682 | Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets | wpdevteam | Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | Medium | 6.4 | 2025-05-27 01:48:49 | Deep Dive |
| CVE-2025-4223 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter | softaculous | Page Builder: Pagelayer – Drag and Drop website builder | Medium | 4.7 | 2025-05-24 04:25:19 | Deep Dive |
| CVE-2024-13427 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link | softaculous | Page Builder: Pagelayer – Drag and Drop website builder | Medium | 6.4 | 2025-05-24 01:41:10 | Deep Dive |
| CVE-2025-39410 | WordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerability | themegusta | Smart Sections Theme Builder - WPBakery Page Builder Addon | Critical | 9.8 | 2025-05-19 18:58:46 | Deep Dive |
| CVE-2025-39369 | WordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability | sihibbs | Posts for Page | Medium | 6.5 | 2025-05-19 16:35:02 | Deep Dive |