Log in Start free

Softaculous

Products

ProductCVEsExploitedLatest
Page Builder: Pagelayer – Drag and Drop website builder14–Jun 13, 2026
Backuply – Backup, Restore, Migrate and Clone6–Oct 16, 2026
SiteSEO – SEO Simplified4–Nov 19, 2025
FileOrganizer – WordPress File Manager4–Dec 7, 2024
Webuzo3–Jul 25, 2024
Loginizer3–Nov 5, 2024
Virtualizor3–Sep 22, 2026
SpeedyCache – Cache, Optimization, Performance3–Oct 10, 2026
PageLayer2–Apr 8, 2026
SpeedyCache1–Aug 26, 2024
FormLayer1–Jul 5, 2026
Loginizer Security1–Nov 5, 2024
GoSMTP Pro1–Oct 16, 2026

Exploited and recent CVEs

  • CVE-2026-96768 High 7.2 GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body 0.2%
  • CVE-2026-93953 High 8.0 Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation 0.3%
  • CVE-2026-104006 Low 3.7 SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check 0.3%
  • CVE-2026-43643 High 7.5 Softaculous Virtualizor Authorization Bypass via Billing Module Handler 0.6%
  • CVE-2026-43642 High 8.1 Softaculous Virtualizor PHP Object Injection via Billing Module Handler 1.0%
  • CVE-2026-43641 Critical 9.8 Softaculous Virtualizor OS Command Injection via Billing Module Handler 3.0%
  • CVE-2026-5114 Medium 4.9 SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read 0.5%
  • CVE-2026-59519 Medium 5.3 WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2026-2470 Medium 4.3 Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' 0.3%
  • CVE-2026-3297 Medium 6.4 Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block 0.2%
  • CVE-2026-2509 Medium 6.4 Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes 0.4%
  • CVE-2026-39469 Medium 4.3 WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2026-2442 Medium 5.3 Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email' 0.3%
  • CVE-2025-13085 Medium 4.3 SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure 0.3%
  • CVE-2025-12814 Medium 5.3 SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset 0.3%
  • CVE-2025-12366 Medium 4.3 Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference 0.3%
  • CVE-2025-12367 Medium 4.3 SiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update 0.2%
  • CVE-2025-10307 Medium 6.5 Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion 0.7%
  • CVE-2025-9277 Medium 6.4 SiteSEO – SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression 0.2%
  • CVE-2025-4223 Medium 4.7 Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter 0.4%
  • CVE-2024-13427 Medium 6.4 Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link 0.3%
  • CVE-2025-2104 Medium 4.3 Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication 0.3%
  • CVE-2024-13430 Medium 4.3 Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode 0.3%
  • CVE-2025-1926 Medium 4.3 Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification 0.2%
  • CVE-2025-24573 Medium 6.5 WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-11010 High 7.2 FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion 0.9%
  • CVE-2024-10097 High 8.1 Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider 0.7%
  • CVE-2024-10097 High 8.1 Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider 0.7%
  • CVE-2024-7985 High 7.5 FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload 2.4%
  • CVE-2024-8669 Critical 9.1 Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection 16.6%