Plugin icon

Builderall for WordPress

builderall-cheetah-for-wp
Plugin closed

Vulnerabilities:

7

Last Updated:

July 14, 2026

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2026-09-09
Title
Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2026-09-09
Title
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
Fixed in
No known fix
CVSS
5.5 (medium)
Published
2026-09-09
Title
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
Fixed in
No known fix
CVSS
5.5 (medium)
Published
2026-07-20
Title
Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes
Fixed in
Fixed in 3.0.2
CVSS
3.7 (low)
Published
2026-02-25
Title
Builderall for WordPress <= 3.0.1 - Authenticated (Contributor+) Remote Code Execution
Fixed in
No known fix
CVSS
7.2 (high)
Published
2025-10-23
Title
Builderall Builder for WordPress <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
6.4 (medium)
Published
2024-03-29
Title
Builderall Builder for WordPress < 2.0.2 - Unauthenticated Server-Side Request Forgery
Fixed in
Fixed in 2.0.2
CVSS
7.2 (high)