Boldgrid vulnerabilities
64 vulnerabilities
Known vulnerabilities in Boldgrid products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 13 products.
Products
13- W3 Total Cache23 vulnerabilities
- Client Invoicing By Sprout Invoices9 vulnerabilities
- Post And Page Builder By Boldgrid – Visual Drag And Drop Editor7 vulnerabilities
- Total Upkeep7 vulnerabilities
- Post And Page Builder By Boldgrid6 vulnerabilities
- Total Upkeep – Wordpress Backup Plugin Plus Restore & Migrate By Boldgrid6 vulnerabilities
- Post And Page Builder5 vulnerabilities
- Sprout Clients4 vulnerabilities
- Weforms – Easy Drag & Drop Contact Form Builder For Wordpress3 vulnerabilities
- Boldgrid Easy SEO – Simple And Effective SEO2 vulnerabilities
- Weforms2 vulnerabilities
- Easy Seo1 vulnerabilities
- Help Scout1 vulnerabilities
CVE-2026-110253boldgridweforms – easy drag & drop contact form builder for wordpress
EPSS score0.28%
The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.CVE-2026-78001boldgridpost and page builder by boldgrid – visual drag and drop editorEPSS score0.16%
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2013-2010automatticwp_super_cache+3EPSS score73.86%
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityCVE-2021-24436boldgridw3_total_cache+1EPSS score1.91%
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.CVE-2021-24427boldgridw3_total_cache+1EPSS score0.62%
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issueCVE-2021-24452boldgridw3_total_cache+1EPSS score1.92%
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.CVE-2025-2257boldgridtotal_upkeep+2EPSS score0.86%
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.CVE-2025-52713boldgridpost and page builder by boldgrid+1EPSS score0.19%
Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.CVE-2025-52711boldgridpost and page builder by boldgrid+1EPSS score0.14%
Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.CVE-2025-52712boldgridpost and page builder by boldgrid+1EPSS score0.22%
Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.CVE-2025-0859boldgridpost_and_page_builder+2EPSS score0.67%
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.CVE-2025-31797boldgridsprout clients+1EPSS score0.36%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.CVE-2025-66118boldgridsprout clients+1EPSS score0.18%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through <= 3.2.1.CVE-2025-22512boldgridhelp scout+1EPSS score0.40%
Missing Authorization vulnerability in BoldGrid Help Scout help-scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Help Scout: from n/a through <= 6.5.6.CVE-2025-22759boldgridpost and page builder by boldgrid+2EPSS score0.31%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Stored XSS.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.5.CVE-2025-69028boldgridweforms+1EPSS score0.21%
Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.CVE-2025-69345boldgridpost and page builder by boldgrid+1EPSS score0.18%
Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.CVE-2025-24606boldgridclient invoicing by sprout invoices+1EPSS score0.27%
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.1.CVE-2025-64227boldgridclient invoicing by sprout invoices+1EPSS score0.38%
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.CVE-2025-64229boldgridclient invoicing by sprout invoices+1EPSS score0.19%
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.