Vulnerabilities:

10

Last Updated:

January 13, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2025-07-28
Title
Bricks Builder < 2.0 - Unauthenticated SQL Injection via `p` Parameter
Fixed in
Fixed in 1.12.5
CVSS
7.5 (high)
Published
2025-07-28
Title
Bricks Builder < 2.0 - Unauthenticated SQL Injection via `p` Parameter
Fixed in
Fixed in 2.0
CVSS
7.5 (high)
Published
2025-02-26
Title
Bricksbuilder < 1.9.7 - Authenticated (Contributor+) Privilege Escalation via create_autosave
Fixed in
Fixed in 1.9.7
CVSS
7.1 (high)
Published
2024-09-13
Title
Bricks < 1.10.2 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.10.2
CVSS
5.4 (medium)
Published
2024-08-16
Title
Bricks < 1.8.2 - Cross-Site Request Forgery via save_settings
Fixed in
Fixed in 1.8.2
CVSS
4.3 (medium)
Published
2024-08-16
Title
Bricks < 1.8.2 - Cross-Site Request Forgery via reset_settings
Fixed in
Fixed in 1.8.2
CVSS
5.4 (medium)
Published
2024-02-14
Title
Bricks < 1.9.6.1 - Unauthenticated Remote Code Execution
Fixed in
Fixed in 1.9.6.1
CVSS
10.0 (critical)
Published
2024-02-13
Title
Bricks < 1.9.6.1 - Unauthenticated Remote Code Execution
Fixed in
Fixed in 1.9.6.1
CVSS
9.8 (critical)
Published
2022-10-03
Title
Bricks Builder < 1.5.4 - Subscriber+ Arbitrary Post/Page Edition
Fixed in
Fixed in 1.5.4
CVSS
7.1 (high)
Published
2022-10-03
Title
Bricks Builder < 1.5.4 - Subscriber+ Remote Code Execution
Fixed in
Fixed in 1.5.4
CVSS
8.8 (high)