Non notée
CVE-2021-24579 The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the…
Description
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Bold Page Builder 3.1 | premières → < 3.1.6 | 3.1.6 |
Autres CVE de Bold Page Builder
Les 5 CVE de Bold Page Builder →
CVE-2026-84028
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting…
6.8
Moyenne
CVE-2026-84022
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before…
6.8
Moyenne
CVE-2026-84021
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an…
6.8
Moyenne
CVE-2022-2089
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow…
Non notée