Exposure of BoldGrid

Blogs, CMS, WordPress plugins
35
exposure score
536
sites use
0
exploited
3
critical
Vexday analysis

O histórico de vulnerabilidades do BoldGrid soma 44 CVEs catalogadas, com 2 classificadas como críticas e nenhuma entrada no catálogo CISA KEV, indicando taxa de exploração ativa abaixo da média geral do catálogo. O tipo de falha predominante é CWE-79 (Cross-Site Scripting), padrão comum em plugins e temas WordPress que demanda atenção contínua em revisões de código e sanitização de entrada. O CVE mais relevante no momento, CVE-2024-12008, apresenta EPSS de 0,0217, sugerindo baixa probabilidade de exploração imediata, mas ainda assim merece acompanhamento dado o surgimento de 4 novas CVEs nos últimos 90 dias, indicando atividade de pesquisa recente sobre esta tecnologia.

CVEs

52 results
CVE-2024-13907MEDIUMTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request ForgeryEPSS 0.5%CVE-2026-32401HIGHWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-22512MEDIUMWordPress Help Scout Plugin <= 6.5.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-64227CRITICALWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-31797MEDIUMWordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-57418MEDIUMWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-2888MEDIUMWordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1692MEDIUMBoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta DescriptionEPSS 0.3%CVE-2025-22759MEDIUMWordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27384CRITICALWordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityEPSS 0.3%CVE-2026-78438HIGHW3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background MutatorEPSS 0.3%CVE-2026-32484HIGHWordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerabilityEPSS 0.3%CVE-2026-18109HIGHW3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.3%CVE-2025-24606MEDIUMWordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-66695MEDIUMWordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerabilityEPSS 0.3%CVE-2024-4400MEDIUMPost and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-3143MEDIUMTotal Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback CancellationEPSS 0.3%CVE-2023-25480MEDIUMWordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2026-57428HIGHWordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52712MEDIUMWordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal VulnerabilityEPSS 0.2%