Breakdance

Breakdance has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 8 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (50%). Other recurring categories include Missing Authorization, Code Injection.

Every one of the 8 issues recorded for Breakdance has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (4) reported by Francesco Carlucci.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Breakdance vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-4605

Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution

Read the full analysis

Vulnerability Records

8 records


2026-08-31 00:00	Breakdance <= 2.8.1 - Missing Authorization Breakdance <= 2.8.1	`N/A`	5.3 Medium	Soflyy	Yes
2026-07-28 00:00	Breakdance <= 2.6.1 - Missing Authorization Breakdance <= 2.6.1	`CVE-2026-65551`	5.3 Medium	johska	Yes
2026-07-15 19:04	Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details Breakdance <= 2.7.1	`CVE-2026-7543`	7.2 High	h0xilo	Yes
2026-07-10 00:00	Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting Breakdance <= 2.7.1	`CVE-2026-57735`	7.2 High	dutafi	Yes
2024-07-31 17:55	Breakdance <= 1.7.2 - Missing Authorization Breakdance <= 1.7.1	`CVE-2024-5331`	4.3 Medium	Francesco Carlucci	Yes
2024-07-31 17:54	Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Breakdance <= 1.7.2	`CVE-2024-5330`	6.4 Medium	Francesco Carlucci	Yes
2024-05-08 00:00	Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution Breakdance <= 1.7.1	`CVE-2024-4605`	8.8 High	Francesco Carlucci	Yes
2024-05-03 00:00	Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta Breakdance <= 1.7.0	`CVE-2023-6854`	6.4 Medium	Francesco Carlucci	Yes

Showing 1–8 of 8 reports