Builderall Builderall for WordPress

• CVE-2026-15820 Medium 6.4 Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting 0.3%
• CVE-2026-15823 Medium 4.3 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter 0.3%
• CVE-2026-15796 Medium 6.4 Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting 0.3%