boldgrid has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.4 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Products
- Post and Page Builder by BoldGrid – Visual Drag and Drop Editor 1
- W3 Total Cache 1
- post-and-page-builder 1
- sprout-invoices 1
- weForms – Easy Drag & Drop Contact Form Builder For WordPress 1
Worst active — by depth score
CVE-2026-87920High· 7.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escap…40CVE-2026-100510High· 7.1Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.39CVE-2026-78001Medium· 6.4The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insu…35CVE-2026-110253Medium· 5.4weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter30CVE-2026-97078Medium· 5.3Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.29
boldgrid vulnerabilities
CVEs affecting boldgrid, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-110253Medium· 5.4weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions…
CVE-2026-78001Medium· 6.4The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insu…
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insu…
CVE-2026-87920High· 7.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escap…
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escap…
CVE-2026-100510High· 7.1Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
CVE-2026-97078Medium· 5.3Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.