CVE-2026-7438Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Exploitation status Not confirmed Fix Affected product B Bold Timeline Lite Published 09/11/2026 Severity Medium CVE-2026-2357Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 08/16/2026 Severity Medium CVE-2026-27429WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product N Nifty Published 06/16/2026 Severity Critical CVE-2026-3694Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 05/14/2026 Severity Medium CVE-2026-27369WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product C Celeste Published 03/05/2026 Severity High CVE-2025-68541WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product I Ippsum Published 02/20/2026 Severity Critical CVE-2025-67997WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product T Travelicious Published 02/20/2026 Severity Critical CVE-2025-67996WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product N Nestin Published 02/20/2026 Severity Critical CVE-2026-25451WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/19/2026 Severity Medium CVE-2025-12159Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/07/2026 Severity Medium CVE-2025-13463Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/07/2026 Severity Medium CVE-2025-12803Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/07/2026 Severity Medium CVE-2025-15267Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/07/2026 Severity Medium CVE-2025-68513WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Timeline Lite Published 12/24/2025 Severity Medium CVE-2025-64233WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product C Codiqa Published 12/18/2025 Severity Critical CVE-2025-54723WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability Exploitation status Not known exploited Fix Affected product D DentiCare Published 12/18/2025 Severity Critical CVE-2025-14032Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode Exploitation status Not known exploited Fix Affected product B Bold Timeline Lite Published 12/12/2025 Severity Medium CVE-2025-66057WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 11/21/2025 Severity Medium CVE-2025-7730Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 10/23/2025 Severity Medium CVE-2025-60216WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product A Addison Published 10/22/2025 Severity Critical CVE-2025-60214WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product G Goldenblatt Published 10/22/2025 Severity Critical CVE-2025-58194WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 08/27/2025 Severity Medium CVE-2025-54006WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 07/16/2025 Severity Medium CVE-2024-5647Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 07/03/2025 Severity Medium CVE-2025-52724WordPress Amwerk theme <= 1.2.0 - PHP Object Injection Vulnerability Exploitation status Not known exploited Fix Affected product A Amwerk Published 06/27/2025 Severity Critical CVE-2025-5286Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 05/29/2025 Severity Medium CVE-2025-39495WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product A Avantage Published 05/23/2025 Severity Critical CVE-2025-39499WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product M Medicare Published 05/23/2025 Severity Critical CVE-2025-3715Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 05/18/2025 Severity Medium CVE-2025-47525WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 05/07/2025 Severity Medium CVE-2025-47488WordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 05/07/2025 Severity Medium CVE-2023-45110WordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product B Bold Timeline Lite Published 01/02/2025 Severity Medium CVE-2024-54382WordPress Bold Page Builder plugin <= 5.1.5 - Path Traversal vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 12/16/2024 Severity Medium CVE-2024-53801WordPress Bold Page Builder plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 12/06/2024 Severity Medium CVE-2024-50417WordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 11/19/2024 Severity Medium CVE-2024-52417WordPress ReConstruction theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product R ReConstruction Published 11/18/2024 Severity High CVE-2024-47298WordPress Bold Page Builder plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 10/06/2024 Severity Medium CVE-2024-47391WordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 10/05/2024 Severity Medium CVE-2024-43294WordPress Bold Timeline Lite plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Timeline Lite Published 08/18/2024 Severity Medium CVE-2024-7100Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 07/30/2024 Severity Medium CVE-2024-2736Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 04/10/2024 Severity Medium CVE-2024-2735Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 04/10/2024 Severity Medium CVE-2024-2734Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 04/10/2024 Severity Medium CVE-2024-2733Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 04/10/2024 Severity Medium CVE-2024-3267Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 04/09/2024 Severity Medium CVE-2024-3266Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 04/09/2024 Severity Medium CVE-2024-30442WordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 03/29/2024 Severity Medium CVE-2024-30179WordPress Bold Page Builder plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 03/27/2024 Severity Medium CVE-2024-1159Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/13/2024 Severity Medium CVE-2024-1157Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/13/2024 Severity Medium CVE-2024-1160Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link Exploitation status Not known exploited Fix Affected product B Bold Page Builder Published 02/13/2024 Severity Medium CVE-2023-49823WordPress Bold Page Builder Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product B Bold Page Builder Published 12/15/2023 Severity Medium CVE-2021-24319Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFS Exploitation status Not confirmed Fix Affected product B Bello - Directory & Listing Published 06/01/2021 Severity Unknown CVE-2021-24320Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS Exploitation status Not confirmed Fix Affected product B Bello - Directory & Listing Published 06/01/2021 Severity Unknown CVE-2021-24321Bello < 1.6.0 - Unauthenticated Blind SQL Injection Exploitation status Not confirmed Fix Affected product B Bello - Directory & Listing Published 06/01/2021 Severity Unknown 
