Log in Start free

BoldThemes

Products

ProductCVEsExploitedLatest
Bold Page Builder41–Sep 30, 2026
Bold Timeline Lite5–Sep 11, 2026
Bello - Directory & Listing3–Jun 1, 2021
Avantage1–May 23, 2025
Celeste1–Mar 5, 2026
Codiqa1–Dec 18, 2025
DentiCare1–Dec 18, 2025
Goldenblatt1–Oct 22, 2025
Ippsum1–Feb 20, 2026
Medicare1–May 23, 2025
Nestin1–Feb 20, 2026
Nifty1–Jun 16, 2026
ReConstruction1–Nov 18, 2024
Addison1–Oct 22, 2025
Travelicious1–Feb 20, 2026
Amwerk1–Jun 27, 2025
Avala1–Oct 10, 2026

Exploited and recent CVEs

  • CVE-2026-62077 Critical 9.8 WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-6173 Medium 6.4 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter 0.2%
  • CVE-2026-6170 Medium 6.4 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute 0.2%
  • CVE-2026-6171 Medium 6.4 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute 0.2%
  • CVE-2026-88037 Medium 6.4 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title 0.2%
  • CVE-2026-6172 Medium 6.4 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter 0.2%
  • CVE-2026-5920 Medium 6.4 Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter 0.3%
  • CVE-2026-62110 Medium 6.5 WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-7438 Medium 6.4 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.4%
  • CVE-2026-2357 Medium 6.4 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2026-27429 Critical 9.8 WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability 0.6%
  • CVE-2026-3694 Medium 6.4 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode 0.2%
  • CVE-2026-27369 High 8.1 WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability 0.4%
  • CVE-2025-68541 Critical 9.8 WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability 0.4%
  • CVE-2025-67997 Critical 9.8 WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability 0.4%
  • CVE-2025-67996 Critical 9.8 WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-25451 Medium 6.5 WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-12159 Medium 6.4 Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.2%
  • CVE-2025-13463 Medium 6.4 Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid 0.3%
  • CVE-2025-12803 Medium 6.4 Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode 0.3%
  • CVE-2025-15267 Medium 6.4 Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode 0.3%
  • CVE-2025-68513 Medium 6.5 WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-64233 Critical 9.8 WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability 0.4%
  • CVE-2025-54723 Critical 9.8 WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability 0.5%
  • CVE-2025-14032 Medium 6.4 Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode 0.3%
  • CVE-2025-66057 Medium 6.5 WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-7730 Medium 6.4 Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter 0.2%
  • CVE-2025-60216 Critical 9.8 WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability 0.6%
  • CVE-2025-60214 Critical 9.8 WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability 0.5%
  • CVE-2025-58194 Medium 6.5 WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerability 0.2%