Builderall For Wordpress

WordPress plugin · builderall-for-wordpress · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Builderall For Wordpress on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
MEDIUM CVSS 6.4	Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting CVE.org	<=3.0.2	unfixed	CVE-2026-15820	Sep 10, 2026
MEDIUM CVSS 4.3	Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter CVE.org	<=3.0.2	unfixed	CVE-2026-15823	Sep 10, 2026
MEDIUM CVSS 6.4	Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting CVE.org	<=3.0.2	unfixed	CVE-2026-15796	Sep 10, 2026
LOW CVSS 3.7	Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes CVE.org	>=0, <3.0.2	v3.0.2	CVE-2026-11882	Aug 1, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.