# cve.now: Softaculous

The newest entries naming Softaculous as an affected vendor (up to 200), of 46 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-96768](https://cve.now/CVE-2026-96768.md): GoSMTP Pro \<= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body (CVSS 7.2)
- [CVE-2026-93953](https://cve.now/CVE-2026-93953.md): Backuply \<= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation (CVSS 8.0)
- [CVE-2026-104006](https://cve.now/CVE-2026-104006.md): SpeedyCache \<= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment\_author\_\* Cookie Check (CVSS 3.7)
- [CVE-2026-43643](https://cve.now/CVE-2026-43643.md): Softaculous Virtualizor Authorization Bypass via Billing Module Handler (CVSS 8.7)
- [CVE-2026-43642](https://cve.now/CVE-2026-43642.md): Softaculous Virtualizor PHP Object Injection via Billing Module Handler (CVSS 9.2)
- [CVE-2026-43641](https://cve.now/CVE-2026-43641.md): Softaculous Virtualizor OS Command Injection via Billing Module Handler (CVSS 9.3)
- [CVE-2026-5114](https://cve.now/CVE-2026-5114.md): SpeedyCache \<= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read (CVSS 4.9)
- [CVE-2026-59519](https://cve.now/CVE-2026-59519.md): WordPress FormLayer plugin \<= 1.0.6 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-2470](https://cve.now/CVE-2026-2470.md): Pagelayer \<= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' (CVSS 4.3)
- [CVE-2026-3297](https://cve.now/CVE-2026-3297.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block (CVSS 6.4)
- [CVE-2026-2509](https://cve.now/CVE-2026-2509.md): Page Builder: Pagelayer \<= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes (CVSS 6.4)
- [CVE-2026-39469](https://cve.now/CVE-2026-39469.md): WordPress PageLayer plugin \<= 2.0.8 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2026-2442](https://cve.now/CVE-2026-2442.md): Pagelayer \<= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email' (CVSS 5.3)
- [CVE-2025-13085](https://cve.now/CVE-2025-13085.md): SiteSEO – SEO Simplified \<= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure (CVSS 4.3)
- [CVE-2025-12814](https://cve.now/CVE-2025-12814.md): SiteSEO – SEO Simplified \<= 1.3.2 - Improper Authorization to Authenticated Settings Reset (CVSS 5.3)
- [CVE-2025-12366](https://cve.now/CVE-2025-12366.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference (CVSS 4.3)
- [CVE-2025-12367](https://cve.now/CVE-2025-12367.md): SiteSEO – SEO Simplified \<= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update (CVSS 4.3)
- [CVE-2025-10307](https://cve.now/CVE-2025-10307.md): Backuply – Backup, Restore, Migrate and Clone \<= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion (CVSS 6.5)
- [CVE-2025-9277](https://cve.now/CVE-2025-9277.md): SiteSEO – SEO Simplified \<= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression (CVSS 6.4)
- [CVE-2025-4223](https://cve.now/CVE-2025-4223.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.0 - Reflected Cross-Site Scripting via login\_url Parameter (CVSS 4.7)
- [CVE-2024-13427](https://cve.now/CVE-2024-13427.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link (CVSS 6.4)
- [CVE-2025-2104](https://cve.now/CVE-2025-2104.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication (CVSS 4.3)
- [CVE-2024-13430](https://cve.now/CVE-2024-13430.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer\_builder\_posts\_shortcode (CVSS 4.3)
- [CVE-2025-1926](https://cve.now/CVE-2025-1926.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification (CVSS 4.3)
- [CVE-2025-24573](https://cve.now/CVE-2025-24573.md): WordPress Pagelayer plugin \<= 1.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-11010](https://cve.now/CVE-2024-11010.md): FileOrganizer \<= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion (CVSS 7.2)
- [CVE-2024-10097](https://cve.now/CVE-2024-10097.md): Loginizer Security and Loginizer \<= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider (CVSS 8.1)
- [CVE-2024-7985](https://cve.now/CVE-2024-7985.md): FileOrganizer \<= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5)
- [CVE-2024-8669](https://cve.now/CVE-2024-8669.md): Backuply – Backup, Restore, Migrate and Clone \<= 1.3.4 - Authenticated (Admin+) SQL Injection (CVSS 9.1)
- [CVE-2024-43299](https://cve.now/CVE-2024-43299.md): WordPress SpeedyCache plugin \<= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-24622](https://cve.now/CVE-2024-24622.md): Softaculous Webuzo Password Reset Command Injection (CVSS 8.8)
- [CVE-2024-24623](https://cve.now/CVE-2024-24623.md): Softaculous Webuzo FTP Management Command Injection (CVSS 8.8)
- [CVE-2024-24621](https://cve.now/CVE-2024-24621.md): Softaculous Webuzo Authentication Bypass (CVSS 9.8)
- [CVE-2024-5599](https://cve.now/CVE-2024-5599.md): FileOrganizer \<= 1.0.7 - Sensitive Information Exposure via Directory Listing (CVSS 7.5)
- [CVE-2024-2324](https://cve.now/CVE-2024-2324.md): FileOrganizer and FileOrganizer Pro \<= 1.0.6 - Authenticated Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-2504](https://cve.now/CVE-2024-2504.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes (CVSS 6.4)
- [CVE-2024-2294](https://cve.now/CVE-2024-2294.md): Backuply – Backup, Restore, Migrate and Clone \<= 1.2.7 - Authenticated (Admin+) Directory Traversal (CVSS 4.9)
- [CVE-2024-2127](https://cve.now/CVE-2024-2127.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (CVSS 6.4)
- [CVE-2024-1590](https://cve.now/CVE-2024-1590.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button (CVSS 4.6)
- [CVE-2024-0842](https://cve.now/CVE-2024-0842.md): Backuply - Backup, Restore, Migrate and Clone \<= 1.2.6 - Denial of Service (CVSS 7.5)
- [CVE-2024-0697](https://cve.now/CVE-2024-0697.md): Backuply – Backup, Restore, Migrate and Clone \<= 1.2.3 - Authenticated (Administrator+) Directory Traversal (CVSS 6.5)
- [CVE-2023-6598](https://cve.now/CVE-2023-6598.md): SpeedyCache \<= 1.1.3 - Missing Authorization to Plugin Options Update (CVSS 4.3)
- [CVE-2023-6738](https://cve.now/CVE-2023-6738.md): PageLayer \<= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields (CVSS 5.4)
- [CVE-2023-41854](https://cve.now/CVE-2023-41854.md): WordPress wpCentral Plugin \<= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2022-45079](https://cve.now/CVE-2022-45079.md): WordPress Loginizer Plugin \<= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.7)
- [CVE-2022-45084](https://cve.now/CVE-2022-45084.md): WordPress Loginizer Plugin \<= 1.7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/softaculous
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.