Softaculous vulnerabilities
46 CVEs and advisories name Softaculous as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-96768GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body
- CVE-2026-93953Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
- CVE-2026-104006SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
- CVE-2026-43643Softaculous Virtualizor Authorization Bypass via Billing Module Handler
- CVE-2026-43642Softaculous Virtualizor PHP Object Injection via Billing Module Handler
- CVE-2026-43641Softaculous Virtualizor OS Command Injection via Billing Module Handler
- CVE-2026-5114SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read
- CVE-2026-59519WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability
- CVE-2026-2470Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
- CVE-2026-3297Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
- CVE-2026-2509Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
- CVE-2026-39469WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability
- CVE-2026-2442Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
- CVE-2025-13085SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure
- CVE-2025-12814SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset
- CVE-2025-12366Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
- CVE-2025-12367SiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update
- CVE-2025-10307Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion
- CVE-2025-9277SiteSEO – SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression
- CVE-2025-4223Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter
- CVE-2024-13427Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link
- CVE-2025-2104Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication
- CVE-2024-13430Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
- CVE-2025-1926Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
- CVE-2025-24573WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-11010FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion
- CVE-2024-10097Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2024-7985FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-8669Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection
- CVE-2024-43299WordPress SpeedyCache plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability