Unauthenticated PHP Object Injection vulnerability in Avala theme versions up to 1.1.4. Defenders responsible for Avala theme installations should assess exposure and prioritize patching or mitigation due to potential unauthenticated exploitation and impact on confidentiality, integrity, and availability. The CVE record and NVD entry provide limited information about the vulnerability, so defenders should [truncated]
A Cross Site Scripting (XSS) vulnerability exists in Bold Page Builder versions up to 5.9.9. This CVE was published on 2026-09-11T19:17:43.850Z and last modified on 2026-09-11T21:17:12.233Z.
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with Contributor-level access and above to inject ar [truncated]
CVE-2026-27429 is a critical vulnerability in the Nifty theme for WordPress, allowing unauthenticated PHP object injection. It has a CVSS score of 9.8 and was published on June 17, 2026. The vulnerability affects Nifty versions up to 1.4.1. Successful exploitation could lead to high impact on confidentiality, integrity, and availability. Administrators of affected systems should apply patches or mitigatio [truncated]
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will [truncated]
