CVE-2021-24579: falha em Bold Page Builder
Bold Page Builder < 3.1.6 - PHP Object Injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 8.2%
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.
Produtos afetados
Unknown · Bold Page BuilderCVEs relacionadas — Bold Page Builder
No mesmo produto, das mais perigosas para as menos.
CVE-2022-2089—Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2026-84028MEDIUMBold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settingsEPSS 0.4%CVE-2026-84022MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element AttributesEPSS 0.4%CVE-2026-84021MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLEPSS 0.4%