Bold Themes

bold-themes

26 CVEs • 4 products

Products (4)

Click to collapse

Toggle

Bold Page Builder

bold_page_builder

Cost Calculator

cost_calculator

Bold Timeline Lite

bold_timeline_lite

CVEs (26)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-24820 1Bold Themes 1Cost Calculator Jun 17, 2026 Feb 28, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers vi...Show more The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's LayoutShow less
CVE-2021-24579 1Bold Themes 1Bold Page Builder Jun 17, 2026 Aug 30, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection....Show more The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.Show less
CVE-2021-24321 1Bold Themes 1Bello Jun 17, 2026 Jun 1, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my...Show more The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issuesShow less
CVE-2021-24320 1Bold Themes 1Bello Jun 17, 2026 Jun 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_l...Show more The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.Show less
CVE-2021-24319 1Bold Themes 1Bello Jun 17, 2026 Jun 1, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scr...Show more The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issueShow less
CVE-2019-15821 1Bold Themes 1Bold Page Builder Jun 17, 2026 Aug 30, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.