Plugin icon

Taskbuilder – Project Management & Task Management Tool With Kanban Board

taskbuilder

Vulnerabilities:

13

Last Updated:

May 21, 2026

Active Installs:

800

Published
Title
Fixed in
CVSS
Published
2026-05-27
Title
Taskbuilder < 5.0.8 - Reflected XSS via Shortcode
Fixed in
Fixed in 5.0.8
CVSS
7.1 (high)
Published
2026-05-13
Title
Taskbuilder – Project Management & Task Management Tool With Kanban Board < 5.0.7 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter
Fixed in
Fixed in 5.0.7
CVSS
6.5 (medium)
Published
2026-03-03
Title
Taskbuilder < 5.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
Fixed in
Fixed in 5.0.4
CVSS
4.4 (medium)
Published
2026-02-17
Title
Taskbuilder < 5.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation
Fixed in
Fixed in 5.0.3
CVSS
4.3 (medium)
Published
2026-02-17
Title
Taskbuilder < 5.0.3 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
Fixed in
Fixed in 5.0.3
CVSS
6.5 (medium)
Published
2026-01-06
Title
Taskbuilder < 5.0.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.0.0
CVSS
6.1 (medium)
Published
2025-06-05
Title
Taskbuilder < 4.0.8 - Missing Authorization
Fixed in
Fixed in 4.0.8
CVSS
5.3 (medium)
Published
2025-04-17
Title
Taskbuilder < 4.0.2 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 4.0.2
CVSS
6.5 (medium)
Published
2025-01-15
Title
Taskbuilder < 3.0.7 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 3.0.7
CVSS
6.5 (medium)
Published
2025-01-03
Title
Taskbuilder – WordPress Project & Task Management plugin < 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode
Fixed in
Fixed in 3.0.7
CVSS
6.4 (medium)
Published
2024-10-31
Title
Taskbuilder < 3.0.5 - Admin+ SQL Injection
Fixed in
Fixed in 3.0.5
CVSS
4.1 (medium)
Published
2024-09-18
Title
Taskbuilder < 3.0.9 - Admin+ SQL Injection
Fixed in
Fixed in 3.0.9
CVSS
4.1 (medium)
Published
2022-09-15
Title
TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload
Fixed in
Fixed in 1.0.8
CVSS
5.4 (medium)