Log in Start free

BoldGrid

Products

ProductCVEsExploitedLatest
W3 Total Cache18–Oct 31, 2026
Client Invoicing by Sprout Invoices9–Sep 30, 2026
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid6–May 1, 2026
Post and Page Builder by BoldGrid6–Sep 30, 2026
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor6–Oct 15, 2026
Sprout Clients4–Jul 23, 2026
weForms – Easy Drag & Drop Contact Form Builder For WordPress3–Oct 17, 2026
Total Upkeep2–Aug 6, 2026
weForms2–Mar 25, 2026
BoldGrid Easy SEO – Simple and Effective SEO2–Apr 6, 2024
Help Scout1–Jan 7, 2025

Exploited and recent CVEs

  • CVE-2026-120019 Medium 5.4 W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder 0.2%
  • CVE-2026-111254 High 7.2 W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry 0.3%
  • CVE-2026-110253 Medium 5.4 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter 0.3%
  • CVE-2026-78001 Medium 6.4 Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute 0.2%
  • CVE-2026-87920 High 7.2 W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content 0.2%
  • CVE-2026-100510 High 7.1 WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-97078 Medium 5.3 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability 0.2%
  • CVE-2026-78438 High 7.2 W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator 0.5%
  • CVE-2026-18109 High 7.2 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name 0.4%
  • CVE-2026-66708 High 8.2 WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability 0.4%
  • CVE-2026-66695 Medium 6.5 WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability 0.4%
  • CVE-2026-57428 High 7.1 WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-57418 Medium 6.5 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability 0.3%
  • CVE-2026-9282 High 7.5 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter 2.9%
  • CVE-2026-57623 Critical 9.0 WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability 0.5%
  • CVE-2026-39595 Medium 4.7 WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability 0.2%
  • CVE-2026-3143 Medium 5.3 Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation 0.3%
  • CVE-2026-39562 Medium 5.3 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability 0.2%
  • CVE-2026-5032 High 7.5 W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header 3.2%
  • CVE-2026-32484 High 8.8 WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability 0.3%
  • CVE-2026-32424 Medium 6.5 WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-32401 High 7.2 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability 0.4%
  • CVE-2026-2707 Medium 6.4 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API 0.2%
  • CVE-2026-27384 Critical 9.0 WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability 0.4%
  • CVE-2026-25364 Medium 5.3 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability 0.2%
  • CVE-2025-69345 Medium 4.3 WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability 0.2%
  • CVE-2025-69028 Medium 5.3 WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability 0.2%
  • CVE-2025-66118 High 7.1 WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-64227 Critical 9.8 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability 0.4%
  • CVE-2025-64229 Medium 4.3 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability 0.2%