Boldgrid vulnerabilities
59 CVEs and advisories name Boldgrid as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120019W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
- CVE-2026-111254W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
- CVE-2026-110253weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
- CVE-2026-78001Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
- CVE-2026-87920W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-100510WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97078WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-78438W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
- CVE-2026-18109W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- CVE-2026-66708WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability
- CVE-2026-66695WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability
- CVE-2026-57428WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57418WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability
- CVE-2026-9282W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
- CVE-2026-57623WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability
- CVE-2026-39595WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability
- CVE-2026-3143Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation
- CVE-2026-39562WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability
- CVE-2026-5032W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
- CVE-2026-32484WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability
- CVE-2026-32424WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32401WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability
- CVE-2026-2707weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
- CVE-2026-27384WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability
- CVE-2026-25364WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability
- CVE-2025-69345WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability
- CVE-2025-69028WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability
- CVE-2025-66118WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-64227WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability
- CVE-2025-64229WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability