Builderall for WordPress

Builderall for WordPress has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 2 are fixed and 5 remain unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (43%). Other recurring categories include Missing Authorization, Code Injection.

2 of the records (29%) have a vendor fix, while 5 remain unpatched. The oldest unresolved one dates back to 2025.

5 independent researchers contributed these findings, most of them (3) reported by Wordfence PRISM.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage29%

Open

Fixed

Get automatic notifications for all Builderall for WordPress vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2026-22390

Builderall for WordPress <= 3.0.1 - Authenticated (Contributor+) Remote Code Execution

Read the full analysis

Vulnerability Records

7 records


2026-09-09 14:49	Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter Builderall for WordPress <= 3.0.2	`CVE-2026-15823`	4.3 Medium	Wordfence PRISM	No
2026-09-09 14:49	Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting Builderall for WordPress <= 3.0.2	`CVE-2026-15820`	6.4 Medium	Wordfence PRISM	No
2026-09-09 14:49	Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting Builderall for WordPress <= 3.0.2	`CVE-2026-15796`	6.4 Medium	Wordfence PRISM	No
2026-07-20 00:00	Builderall for WordPress <= 3.0.1 - Missing Authorization to Unauthenticated OAuth Update Builderall for WordPress <= 3.0.1	`CVE-2026-11882`	5.3 Medium	Pablo González and Fran Ramírez	Yes
2026-02-25 00:00	Builderall for WordPress <= 3.0.1 - Authenticated (Contributor+) Remote Code Execution Builderall for WordPress <= 3.0.1	`CVE-2026-22390`	8.8 High	Doan Dinh Van (d52v)	No
2025-10-23 00:00	Builderall Builder for WordPress <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Builderall for WordPress <= 3.0.1	`CVE-2025-62987`	6.4 Medium	Muhammad Yudha - DJ	No
2024-03-29 00:00	Builderall Builder for WordPress <= 2.0.1 - Unauthenticated Server-Side Request Forgery Builderall for WordPress <= 2.0.1	`CVE-2024-30532`	7.2 High	Majed Refaea	Yes

Showing 1–7 of 7 reports