Softaculous
42 CVEs across 16 Softaculous products. Browse Softaculous vulnerabilities, severities, and proof-of-concept exploits.
Softaculous products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5114 | Medium | 4.9 | 2026-07-28 | The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mism… |
CVE-2026-59519 | Medium | 5.3 | 2026-07-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer… |
CVE-2026-3297 | Medium | 6.4 | 2026-06-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions… |
CVE-2026-2470 | Medium | 4.3 | 2026-06-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including… |
CVE-2026-2509 | Medium | 6.4 | 2026-04-08 | The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions u… |
CVE-2026-39469 | Medium | 4.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive… |
CVE-2026-2442 | Medium | 5.3 | 2026-03-28 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection')… |
CVE-2025-13085 | Medium | 4.3 | 2025-11-19 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and inclu… |
CVE-2025-12814 | Medium | 5.3 | 2025-11-19 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_s… |
CVE-2025-12366 | Medium | 4.3 | 2025-11-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i… |
CVE-2025-12367 | Medium | 4.3 | 2025-11-01 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not… |
CVE-2025-10307 | Medium | 6.5 | 2025-09-26 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… |
CVE-2025-9277 | Medium | 6.4 | 2025-08-26 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, an… |
CVE-2025-4223 | Medium | 4.7 | 2025-05-24 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘login_url’ parameter… |
CVE-2024-13427 | Medium | 6.4 | 2025-05-24 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in… |
CVE-2025-2104 | Medium | 4.3 | 2025-03-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation… |
CVE-2024-13430 | Medium | 4.3 | 2025-03-12 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1… |
CVE-2025-1926 | Medium | 4.3 | 2025-03-10 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2025-24573 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This… |
CVE-2024-11010 | High | 7.2 | 2024-12-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and includi… |
CVE-2024-10097 | High | 8.1 | 2024-11-05 | The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to… |
CVE-2024-7985 | High | 7.5 | 2024-10-29 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2024-8669 | Critical | 9.1 | 2024-09-14 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuply_wp_clo… |
CVE-2024-43299 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8. |
CVE-2024-24623 | High | 8.8 | 2024-07-25 | Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerabil… |
CVE-2024-24622 | High | 8.8 | 2024-07-25 | Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain co… |
CVE-2024-24621 | Critical | 9.8 | 2024-07-25 | Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulne… |
CVE-2024-5599 | High | 7.5 | 2024-06-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… |
CVE-2024-2324 | Medium | 4.4 | 2024-05-02 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up… |
CVE-2024-2504 | Medium | 6.4 | 2024-04-09 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' parameter in all v… |
CVE-2024-2294 | Medium | 4.9 | 2024-03-16 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the… |
CVE-2024-2127 | Medium | 6.4 | 2024-03-07 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all vers… |
CVE-2024-1590 | Medium | 4.6 | 2024-02-23 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in… |
CVE-2024-0842 | High | 7.5 | 2024-02-09 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.6. This is… |
CVE-2024-1189 | Medium | 5.3 | 2024-02-02 | A vulnerability has been found in AMPPS 2.7 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Encrypti… |
CVE-2024-0697 | Medium | 6.5 | 2024-01-27 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the… |
CVE-2023-6598 | Medium | 4.3 | 2024-01-11 | The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, sp… |
CVE-2023-6738 | Medium | 5.4 | 2024-01-04 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code'… |
CVE-2023-49746 | Medium | 4.9 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Opt… |
CVE-2022-45079 | Medium | 4.7 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions. |
CVE-2022-45084 | Medium | 6.3 | 2023-04-24 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions. |
CVE-2020-26886 | High | 7.8 | 2021-03-18 | Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Stores. This leads to pr… |
CVE-2017-6513 | Critical | 9.9 | 2017-03-11 | The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to con… |
CVE-2013-6043 | | 2014-12-27 | The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user accou… | |
CVE-2013-6041 | | 2014-12-27 | index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within… | |
CVE-2013-6042 | | 2013-11-19 | Cross-site scripting (XSS) vulnerability in filemanager/login.php in the File Manager module in Softaculous Webuzo before 2.1.4 allows remote attackers to inje… |