Skip to content
Noroxi

Post and Page Builder by BoldGrid – Visual Drag and Drop Editor

post-and-page-builder · plugin

Known security vulnerabilities for Post and Page Builder by BoldGrid – Visual Drag and Drop Editor. Find out in seconds which version runs on your site with WP Lens.

10 known vulnerabilities

3 exploitable without logging in · latest Sep 30, 2026

Listed on wordpress.org · latest 1.27.15 · last updated Sep 25, 2026 · 50K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2023-25480unauthenticated · needs a click≤ 1.24.1

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2026-100510unauthenticated · needs a click≤ 1.27.14

    WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-0859contributor+≤ 1.27.6

    Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function

    Medium 6.5

  • CVE-2025-52713login required≤ 1.27.8

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability

    Medium 6.4

  • CVE-2025-22759login required≤ 1.27.5

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-2888login required≤ 1.26.2

    WordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-6848contributor+≤ 1.26.6

    Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload

    Medium 5.4

  • CVE-2025-52711unauthenticated · needs a click≤ 1.27.8

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability

    Medium 4.3

  • CVE-2025-69345login required≤ 1.27.9

    WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2025-52712login required≤ 1.27.8

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal Vulnerability

    Medium 4.2

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory