Builderall For Wordpress
Monthly
Stored cross-site scripting in the Builderall for WordPress plugin (versions ≤3.0.2) allows authenticated contributors to inject persistent JavaScript via the Photo Module's unsanitized 'attributes' setting, executing against any subsequent visitor to an affected page. The attack requires only contributor-level WordPress credentials and results in scope-changed impact against victim browsers, enabling session hijacking or malicious redirects. No public exploit code or active exploitation has been identified; Wordfence reported the issue with precise source-code references across multiple affected PHP files.
Unauthorized post-layout tampering in the Builderall Cheetah For WP WordPress plugin (≤3.0.2) allows any authenticated Subscriber-level user to disable the page builder layout on arbitrary posts site-wide. The wp_ajax_ba_cheetah_disable AJAX handler registers the disable() function without any capability check or nonce verification, and accepts an attacker-controlled post_id directly from $_POST input. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Stored XSS in the Builderall for WordPress plugin (all versions through 3.0.2) enables authenticated contributors to inject persistent JavaScript via the 'bg_video_service_url' page-builder setting, with payloads executing in the browsers of any subsequent visitor - including administrators - who loads an affected page. The flaw is rooted in absent input sanitization and output escaping across the plugin's AJAX handling, model storage, and rendering pipeline, as confirmed by Wordfence and Trac source references. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for at least contributor-level WordPress credentials.
Unauthenticated OAuth state hijacking in Builderall for WordPress (versions before 3.0.2) enables remote attackers to overwrite the plugin's stored third-party integration access token by completing an OAuth authorization flow that is never bound to the initiating user session. Practical impact is constrained to sites already connected to a paid Builderall account - without that precondition, the overwrite is transient rather than durable. No confirmed active exploitation exists in CISA KEV, but WPScan has published a public proof-of-concept, making this accessible beyond sophisticated attackers despite an EPSS of 0.18% (7th percentile).
Stored cross-site scripting in the Builderall for WordPress plugin (versions ≤3.0.2) allows authenticated contributors to inject persistent JavaScript via the Photo Module's unsanitized 'attributes' setting, executing against any subsequent visitor to an affected page. The attack requires only contributor-level WordPress credentials and results in scope-changed impact against victim browsers, enabling session hijacking or malicious redirects. No public exploit code or active exploitation has been identified; Wordfence reported the issue with precise source-code references across multiple affected PHP files.
Unauthorized post-layout tampering in the Builderall Cheetah For WP WordPress plugin (≤3.0.2) allows any authenticated Subscriber-level user to disable the page builder layout on arbitrary posts site-wide. The wp_ajax_ba_cheetah_disable AJAX handler registers the disable() function without any capability check or nonce verification, and accepts an attacker-controlled post_id directly from $_POST input. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Stored XSS in the Builderall for WordPress plugin (all versions through 3.0.2) enables authenticated contributors to inject persistent JavaScript via the 'bg_video_service_url' page-builder setting, with payloads executing in the browsers of any subsequent visitor - including administrators - who loads an affected page. The flaw is rooted in absent input sanitization and output escaping across the plugin's AJAX handling, model storage, and rendering pipeline, as confirmed by Wordfence and Trac source references. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for at least contributor-level WordPress credentials.
Unauthenticated OAuth state hijacking in Builderall for WordPress (versions before 3.0.2) enables remote attackers to overwrite the plugin's stored third-party integration access token by completing an OAuth authorization flow that is never bound to the initiating user session. Practical impact is constrained to sites already connected to a paid Builderall account - without that precondition, the overwrite is transient rather than durable. No confirmed active exploitation exists in CISA KEV, but WPScan has published a public proof-of-concept, making this accessible beyond sophisticated attackers despite an EPSS of 0.18% (7th percentile).