boldgrid
- Total products in the ecosystem
- 11
- Total vulnerabilities (90 days)
- 9
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, boldgrid recorded 9 security vulnerabilities in the last 90 days across 5 products, including 5 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, W3 Total Cache had the most security vulnerabilities in the boldgrid ecosystem, with 5 vulnerabilities—approximately 55.56% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-120019W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify PlaceholderCVE-2026-111254W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License ExpiryCVE-2026-110253weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' ParameterCVE-2026-78001Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' AttributeCVE-2026-87920W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-120019W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder | Exploitation statusNot exploited | FixYes |
| Affected productW3 Total Cache |
| Published10/31/2026 |
| SeverityMedium |
CVE-2026-111254W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published10/31/2026 | SeverityHigh |
|---|
CVE-2026-110253weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter | Exploitation statusNot exploited | FixYes | Affected productweForms – Easy Drag & Drop Contact Form Builder For WordPress | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-78001Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid – Visual Drag and Drop Editor | Published10/15/2026 | SeverityMedium |
|---|
CVE-2026-87920W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-97078WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published09/30/2026 | SeverityMedium |
|---|
CVE-2026-100510WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-78438W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published09/05/2026 | SeverityHigh |
|---|
CVE-2026-18109W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-66708WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productTotal Upkeep | Published08/06/2026 | SeverityHigh |
|---|
CVE-2026-66695Unauthenticated path traversal in BoldGrid W3 Total Cache enables unintended path access | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published08/06/2026 | SeverityMedium |
|---|
CVE-2026-57428WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productSprout Clients | Published07/23/2026 | SeverityHigh |
|---|
CVE-2026-57418WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published07/13/2026 | SeverityMedium |
|---|
CVE-2026-9282W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published07/11/2026 | SeverityHigh |
|---|
CVE-2026-57623WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published07/02/2026 | SeverityCritical |
|---|
CVE-2026-39595WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published06/17/2026 | SeverityMedium |
|---|
CVE-2026-3143Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation | Exploitation statusNot exploited | FixYes | Affected productTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | Published05/01/2026 | SeverityMedium |
|---|
CVE-2026-39562WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published04/08/2026 | SeverityMedium |
|---|
CVE-2026-5032W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published04/02/2026 | SeverityHigh |
|---|
CVE-2026-32484WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productweForms | Published03/25/2026 | SeverityHigh |
|---|
CVE-2026-32424WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productSprout Clients | Published03/13/2026 | SeverityMedium |
|---|
CVE-2026-32401WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published03/13/2026 | SeverityHigh |
|---|
CVE-2026-2707weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API | Exploitation statusNot exploited | FixYes | Affected productweForms – Easy Drag & Drop Contact Form Builder For WordPress | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-27384WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published03/05/2026 | SeverityCritical |
|---|
CVE-2026-25364WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published02/19/2026 | SeverityMedium |
|---|
CVE-2025-69345WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid | Published01/06/2026 | SeverityMedium |
|---|
CVE-2025-69028WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productweForms | Published12/30/2025 | SeverityMedium |
|---|
CVE-2025-66118WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productSprout Clients | Published12/18/2025 | SeverityHigh |
|---|
CVE-2025-64227WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published12/18/2025 | SeverityCritical |
|---|
CVE-2025-64229WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published10/29/2025 | SeverityMedium |
|---|
CVE-2025-52712WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal Vulnerability | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid | Published08/14/2025 | SeverityMedium |
|---|
CVE-2020-36848Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download | Exploitation statusNot exploited | FixYes | Affected productTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | Published07/12/2025 | SeverityHigh |
|---|
CVE-2025-52713WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid | Published06/20/2025 | SeverityMedium |
|---|
CVE-2025-52711WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid | Published06/20/2025 | SeverityMedium |
|---|
CVE-2025-31797WordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productSprout Clients | Published04/01/2025 | SeverityMedium |
|---|
CVE-2025-2257Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection | Exploitation statusNot exploited | FixYes | Affected productTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | Published03/26/2025 | SeverityHigh |
|---|
CVE-2024-13907Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery | Exploitation statusNot exploited | FixYes | Affected productTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | Published02/27/2025 | SeverityMedium |
|---|
CVE-2025-0859Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid – Visual Drag and Drop Editor | Published02/06/2025 | SeverityMedium |
|---|
CVE-2025-24606WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published01/27/2025 | SeverityMedium |
|---|
CVE-2025-22759WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid | Published01/15/2025 | SeverityMedium |
|---|
CVE-2024-12365W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published01/14/2025 | SeverityHigh |
|---|
CVE-2024-12008W3 Total Cache <= 2.8.1 Information Exposure via Log Files | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published01/14/2025 | SeverityMedium |
|---|
CVE-2024-12006W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published01/14/2025 | SeverityMedium |
|---|
CVE-2025-22512WordPress Help Scout Plugin <= 6.5.6 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productHelp Scout | Published01/07/2025 | SeverityMedium |
|---|
CVE-2024-53819WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productClient Invoicing by Sprout Invoices | Published12/09/2024 | SeverityMedium |
|---|
CVE-2024-9461Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings | Exploitation statusNot exploited | FixYes | Affected productTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | Published11/26/2024 | SeverityHigh |
|---|
CVE-2023-5359W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext | Exploitation statusNot exploited | FixYes | Affected productW3 Total Cache | Published09/24/2024 | SeverityLow |
|---|
CVE-2024-6848Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid – Visual Drag and Drop Editor | Published07/20/2024 | SeverityMedium |
|---|
CVE-2024-24869WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerability | Exploitation statusNot exploited | FixYes | Affected productTotal Upkeep | Published05/17/2024 | SeverityHigh |
|---|
CVE-2024-4400Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productPost and Page Builder by BoldGrid – Visual Drag and Drop Editor | Published05/16/2024 | SeverityMedium |
|---|
59 Results | Page 1 of 2