Builderall for WordPress vulnerabilities
3 known CVE vulnerabilities in Builderall for WordPress, translated and rated.
- CVE-2026-15820Medium
The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the Photo Module 'attributes' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.
- CVE-2026-15796Medium
The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'bg_video_service_url' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.
- CVE-2026-11882Low
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token.