CVE-2026-15820
MediumCVSS 6.4Summary
The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the Photo Module 'attributes' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.
Risk Assessment
An authenticated attacker with Contributor-level access or above can inject arbitrary scripts that execute for users visiting the injected page, potentially leading to session theft or account takeover.
Recommendation
Update the Builderall for WordPress plugin to a version newer than 3.0.2. Until then, restrict Contributor-level permissions and consider disabling the Photo module.
Other vulnerabilities in Builderall for WordPress
See all- CVE-2026-15796Medium
The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'bg_video_service_url' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.
- CVE-2026-11882Low
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token.
Original NVD description (English source)
The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.