# cve.now: Boldgrid

The newest entries naming Boldgrid as an affected vendor (up to 200), of 59 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120019](https://cve.now/CVE-2026-120019.md): W3 Total Cache \<= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder (CVSS 5.4)
- [CVE-2026-111254](https://cve.now/CVE-2026-111254.md): W3 Total Cache \<= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry (CVSS 7.2)
- [CVE-2026-110253](https://cve.now/CVE-2026-110253.md): weForms \<= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf\_files' Parameter (CVSS 5.4)
- [CVE-2026-78001](https://cve.now/CVE-2026-78001.md): Post and Page Builder by BoldGrid \<= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute (CVSS 6.4)
- [CVE-2026-87920](https://cve.now/CVE-2026-87920.md): W3 Total Cache \<= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2)
- [CVE-2026-100510](https://cve.now/CVE-2026-100510.md): WordPress Post and Page Builder by BoldGrid plugin \<= 1.27.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97078](https://cve.now/CVE-2026-97078.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-78438](https://cve.now/CVE-2026-78438.md): W3 Total Cache \<= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator (CVSS 7.2)
- [CVE-2026-18109](https://cve.now/CVE-2026-18109.md): W3 Total Cache \<= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 7.2)
- [CVE-2026-66708](https://cve.now/CVE-2026-66708.md): WordPress Total Upkeep plugin \<= 1.17.2 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2026-66695](https://cve.now/CVE-2026-66695.md): WordPress W3 Total Cache plugin \<= 2.10.2 - Path Traversal vulnerability (CVSS 6.5)
- [CVE-2026-57428](https://cve.now/CVE-2026-57428.md): WordPress Sprout Clients plugin \<= 3.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57418](https://cve.now/CVE-2026-57418.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.13 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-9282](https://cve.now/CVE-2026-9282.md): W3 Total Cache \<= 2.9.4 - Unauthenticated Arbitrary File Read via 'f\_array\[\]' Parameter (CVSS 7.5)
- [CVE-2026-57623](https://cve.now/CVE-2026-57623.md): WordPress W3 Total Cache plugin \<= 2.9.4 - Arbitrary Code Execution vulnerability (CVSS 9.0)
- [CVE-2026-39595](https://cve.now/CVE-2026-39595.md): WordPress W3 Total Cache plugin \<= 2.9.1 - Broken Access Control vulnerability (CVSS 4.7)
- [CVE-2026-3143](https://cve.now/CVE-2026-3143.md): Total Upkeep \<= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation (CVSS 5.3)
- [CVE-2026-39562](https://cve.now/CVE-2026-39562.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.10 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-5032](https://cve.now/CVE-2026-5032.md): W3 Total Cache \<= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header (CVSS 7.5)
- [CVE-2026-32484](https://cve.now/CVE-2026-32484.md): WordPress weForms plugin \<= 1.6.26 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-32424](https://cve.now/CVE-2026-32424.md): WordPress Sprout Clients plugin \<= 3.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-32401](https://cve.now/CVE-2026-32401.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.9 - Local File Inclusion vulnerability (CVSS 7.2)
- [CVE-2026-2707](https://cve.now/CVE-2026-2707.md): weForms \<= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API (CVSS 6.4)
- [CVE-2026-27384](https://cve.now/CVE-2026-27384.md): WordPress W3 Total Cache plugin \<= 2.9.1 - Arbitrary Code Execution vulnerability (CVSS 9.0)
- [CVE-2026-25364](https://cve.now/CVE-2026-25364.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.8 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-69345](https://cve.now/CVE-2025-69345.md): WordPress Post and Page Builder by BoldGrid plugin \<= 1.27.9 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-69028](https://cve.now/CVE-2025-69028.md): WordPress weForms plugin \<= 1.6.25 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-66118](https://cve.now/CVE-2025-66118.md): WordPress Sprout Clients plugin \<= 3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-64227](https://cve.now/CVE-2025-64227.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.7 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-64229](https://cve.now/CVE-2025-64229.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.7 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-52712](https://cve.now/CVE-2025-52712.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \<= 1.27.8 - Path Traversal Vulnerability (CVSS 4.2)
- [CVE-2020-36848](https://cve.now/CVE-2020-36848.md): Total Upkeep by BoldGrid \<= 1.14.9 - Unauthenticated Backup Download (CVSS 7.5)
- [CVE-2025-52713](https://cve.now/CVE-2025-52713.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin \<= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 6.4)
- [CVE-2025-52711](https://cve.now/CVE-2025-52711.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin \<= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-31797](https://cve.now/CVE-2025-31797.md): WordPress Sprout Clients plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-2257](https://cve.now/CVE-2025-2257.md): Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid \<= 1.16.10 - Authenticated (Admin+) Command Injection (CVSS 7.2)
- [CVE-2024-13907](https://cve.now/CVE-2024-13907.md): Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid \<= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 4.9)
- [CVE-2025-0859](https://cve.now/CVE-2025-0859.md): Post and Page Builder by BoldGrid \<= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template\_via\_url Function (CVSS 6.5)
- [CVE-2025-24606](https://cve.now/CVE-2025-24606.md): WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin \<=20.8.1 - Broken Access Control vulnerability (CVSS 6.4)
- [CVE-2025-22759](https://cve.now/CVE-2025-22759.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin \<= 1.27.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-12008](https://cve.now/CVE-2024-12008.md): W3 Total Cache \<= 2.8.1 Information Exposure via Log Files (CVSS 5.3)
- [CVE-2024-12006](https://cve.now/CVE-2024-12006.md): W3 Total Cache \<= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation (CVSS 5.3)
- [CVE-2024-12365](https://cve.now/CVE-2024-12365.md): W3 Total Cache \<= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery (CVSS 8.5)
- [CVE-2025-22512](https://cve.now/CVE-2025-22512.md): WordPress Help Scout Plugin \<= 6.5.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-53819](https://cve.now/CVE-2024-53819.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2024-9461](https://cve.now/CVE-2024-9461.md): Total Upkeep \<= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings (CVSS 7.2)
- [CVE-2023-5359](https://cve.now/CVE-2023-5359.md): W3 Total Cache \<= 2.7.5 - Sensitive Credentials Stored in Plaintext (CVSS 3.7)
- [CVE-2024-6848](https://cve.now/CVE-2024-6848.md): Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \<= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload (CVSS 6.4)
- [CVE-2024-24869](https://cve.now/CVE-2024-24869.md): WordPress Total Upkeep plugin \<= 1.15.8 - Arbitrary File Download vulnerability (CVSS 7.5)
- [CVE-2024-4400](https://cve.now/CVE-2024-4400.md): Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \<= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2950](https://cve.now/CVE-2024-2950.md): BoldGrid Easy SEO – Simple and Effective SEO \<= 1.6.14 - Information Exposure (CVSS 5.3)
- [CVE-2024-1692](https://cve.now/CVE-2024-1692.md): BoldGrid Easy SEO – Simple and Effective SEO \<= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description (CVSS 6.4)
- [CVE-2024-2888](https://cve.now/CVE-2024-2888.md): WordPress Post and Page Builder by BoldGrid plugin \<= 1.26.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-0386](https://cve.now/CVE-2024-0386.md): weForms \<= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer (CVSS 7.2)
- [CVE-2023-25480](https://cve.now/CVE-2023-25480.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin \<= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-4932](https://cve.now/CVE-2022-4932.md): Total Upkeep \<= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure (CVSS 4.3)
- [CVE-2021-24452](https://cve.now/CVE-2021-24452.md): W3 Total Cache \< 2.1.5 - Reflected XSS in Extensions Page (JS Context) (no CVSS)
- [CVE-2021-24436](https://cve.now/CVE-2021-24436.md): W3 Total Cache \< 2.1.4 - Reflected XSS in Extensions Page (Attribute Context) (no CVSS)
- [CVE-2021-24427](https://cve.now/CVE-2021-24427.md): W3 Total Cache \< 2.1.3 - Authenticated Stored XSS (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/boldgrid
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.