Boldgrid
58 CVEs across 16 Boldgrid products. Browse Boldgrid vulnerabilities, severities, and proof-of-concept exploits.
Boldgrid products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18109 | High | 7.2 | 2026-08-14 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due t… |
CVE-2026-66708 | High | 8.2 | 2026-08-06 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. |
CVE-2026-66695 | Medium | 6.5 | 2026-08-06 | Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions. |
CVE-2026-57428 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. |
CVE-2026-57418 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-9282 | High | 7.5 | 2026-07-11 | The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This ma… |
CVE-2026-57623 | Critical | 9.0 | 2026-07-02 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. |
CVE-2026-39595 | Medium | 4.7 | 2026-06-17 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. |
CVE-2026-3143 | Medium | 5.3 | 2026-05-01 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2026-39562 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-5032 | High | 7.5 | 2026-04-02 | The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing… |
CVE-2026-32484 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26. |
CVE-2026-32424 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS… |
CVE-2026-32401 | High | 7.2 | 2026-03-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout In… |
CVE-2026-2707 | Medium | 6.4 | 2026-03-11 | The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including… |
CVE-2026-27384 | Critical | 9.0 | 2026-03-05 | Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrai… |
CVE-2026-25364 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-69345 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-69028 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weFo… |
CVE-2025-66118 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected X… |
CVE-2025-64227 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Clie… |
CVE-2025-64229 | Medium | 4.3 | 2025-10-29 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-52712 | Medium | 4.2 | 2025-08-14 | Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and… |
CVE-2020-36848 | High | 7.5 | 2025-07-12 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi… |
CVE-2025-52713 | Medium | 6.4 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Request Forgery.This is… |
CVE-2025-52711 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issu… |
CVE-2025-31797 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS… |
CVE-2025-2257 | High | 7.2 | 2025-03-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2024-13907 | Medium | 4.9 | 2025-02-27 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions… |
CVE-2025-0859 | Medium | 6.5 | 2025-02-06 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including… |
CVE-2025-24606 | Medium | 6.4 | 2025-01-27 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-22759 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-… |
CVE-2024-12365 | High | 8.5 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in al… |
CVE-2024-12008 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug lo… |
CVE-2024-12006 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versio… |
CVE-2025-22512 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in BoldGrid Help Scout help-scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-53819 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: fro… |
CVE-2024-9461 | High | 7.2 | 2024-11-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2023-5359 | Low | 3.7 | 2024-09-25 | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets st… |
CVE-2024-6848 | Medium | 6.4 | 2024-07-20 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all v… |
CVE-2024-24869 | High | 7.5 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep allows Relative Path Traversal.This issue… |
CVE-2024-4400 | Medium | 6.4 | 2024-05-16 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter… |
CVE-2024-2950 | Medium | 5.3 | 2024-04-06 | The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.14 via me… |
CVE-2024-1692 | Medium | 6.4 | 2024-03-30 | The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the meta description field in all versio… |
CVE-2024-2888 | Medium | 6.5 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag… |
CVE-2024-0386 | High | 7.2 | 2024-03-12 | The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and including, 1.6.21 due to… |
CVE-2023-25480 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions. |
CVE-2022-4932 | Medium | 4.3 | 2023-03-07 | The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on… |
CVE-2021-24452 | Medium | 6.1 | 2021-07-19 | The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extension… |
CVE-2021-24436 | Medium | 6.1 | 2021-07-19 | The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" paramet… |
CVE-2021-24427 | Medium | 4.8 | 2021-07-12 | The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them… |
CVE-2013-2010 | Critical | 9.8 | 2020-02-12 | WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability |
CVE-2012-6079 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys. |
CVE-2012-6078 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes. |
CVE-2012-6077 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files. |
CVE-2019-6715 | High | 7.5 | 2019-04-01 | pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionC… |
CVE-2014-9414 | | 2014-12-24 | The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forge… | |
CVE-2014-8724 | | 2014-12-19 | Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inje… |