Softaculous vulnerabilities

Products

• Page Builder: Pagelayer – Drag And Drop Website Builder 14
• Backuply – Backup, Restore, Migrate And Clone 6
• Webuzo 6
• Pagelayer 5
• Fileorganizer – Wordpress File Manager 4
• Loginizer 4
• Siteseo – Seo Simplified 4
• Speedycache – Cache, Optimization, Performance 4
• Backuply 3
• Speedycache 3
• Virtualizor 3
• Formlayer 2

Newest

• softaculous gosmtp pro GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body CVE-2026-96768 7.2 HighOctober 16, 2026
• softaculous backuply – backup, restore, migrate and clone Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation CVE-2026-93953 8.0 HighOctober 16, 2026
• softaculous speedycache – cache, optimization, performance SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check CVE-2026-104006 3.7 LowOctober 10, 2026
• softaculous virtualizor Softaculous Virtualizor Authorization Bypass via Billing Module Handler CVE-2026-43643 8.7 HighSeptember 22, 2026
• softaculous virtualizor Softaculous Virtualizor PHP Object Injection via Billing Module Handler CVE-2026-43642 9.2 CriticalSeptember 22, 2026
• softaculous virtualizor Softaculous Virtualizor OS Command Injection via Billing Module Handler CVE-2026-43641 9.3 CriticalSeptember 22, 2026
• softaculous formlayer FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response CVE-2026-78151 5.3 MediumSeptember 2, 2026
• softaculous speedycache – cache, optimization, performance SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read CVE-2026-5114 4.9 MediumJuly 28, 2026
• softaculous formlayer WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability CVE-2026-59519 5.3 MediumJuly 5, 2026
• softaculous page builder: pagelayer – drag and drop website builder Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' CVE-2026-2470 4.3 MediumJune 13, 2026
• softaculous page builder: pagelayer – drag and drop website builder Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block CVE-2026-3297 6.4 MediumJune 13, 2026
• softaculous page builder: pagelayer – drag and drop website builder Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes CVE-2026-2509 6.4 MediumApril 8, 2026
• softaculous pagelayer WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability CVE-2026-39469 4.3 MediumApril 8, 2026
• softaculous page builder: pagelayer – drag and drop website builder Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email' CVE-2026-2442 5.3 MediumMarch 28, 2026
• softaculous siteseo – seo simplified SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure CVE-2025-13085 4.3 MediumNovember 19, 2025
• softaculous siteseo – seo simplified SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset CVE-2025-12814 5.3 MediumNovember 19, 2025
• softaculous page builder: pagelayer – drag and drop website builder Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference CVE-2025-12366 4.3 MediumNovember 13, 2025
• softaculous siteseo – seo simplified SiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update CVE-2025-12367 4.3 MediumNovember 1, 2025
• softaculous backuply – backup, restore, migrate and clone Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion CVE-2025-10307 Public exploit 6.5 MediumSeptember 26, 2025
• softaculous siteseo – seo simplified SiteSEO – SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression CVE-2025-9277 6.4 MediumAugust 26, 2025
• softaculous page builder: pagelayer – drag and drop website builder Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter CVE-2025-4223 4.7 MediumMay 24, 2025
• softaculous page builder: pagelayer – drag and drop website builder Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link CVE-2024-13427 6.4 MediumMay 24, 2025
• pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 more Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication CVE-2025-2104 4.3 MediumMarch 13, 2025
• pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 more Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode CVE-2024-13430 4.3 MediumMarch 12, 2025
• pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 more Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification CVE-2025-1926 4.3 MediumMarch 10, 2025
• softaculous pagelayer WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability CVE-2025-24573 6.5 MediumJanuary 24, 2025
• pagelayer team pagelayer WordPress Pagelayer plugin <= 1.7.7 - Broken Access Control vulnerability CVE-2023-49196 4.3 MediumDecember 9, 2024
• softaculous fileorganizer – wordpress file manager, fileorganizer manage wordpress and website files +1 more FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion CVE-2024-11010 7.2 HighDecember 7, 2024
• loginizer, softaculous loginizer security +1 more Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider CVE-2024-10097 8.1 HighNovember 5, 2024
• fileorganizer, softaculous fileorganizer – wordpress file manager +1 more FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-7985 Public exploit 7.5 HighOctober 4, 2024
• pagelayer WordPress Page Builder: Pagelayer – Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability CVE-2024-43972 5.9 MediumSeptember 17, 2024
• softaculous backuply, backuply – backup, restore, migrate and clone +1 more Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection CVE-2024-8669 EPSS 16.6% 9.1 CriticalSeptember 14, 2024
• softaculous speedycache WordPress SpeedyCache plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-43299 5.4 MediumAugust 26, 2024
• softaculous webuzo Softaculous Webuzo Password Reset Command Injection CVE-2024-24622 8.8 HighJuly 25, 2024
• softaculous webuzo Softaculous Webuzo FTP Management Command Injection CVE-2024-24623 8.8 HighJuly 25, 2024
• softaculous webuzo Softaculous Webuzo Authentication Bypass CVE-2024-24621 9.8 CriticalJuly 25, 2024
• pagelayer WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability CVE-2024-30465 6.5 MediumJune 9, 2024
• fileorganizer, softaculous fileorganizer – wordpress file manager +1 more FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing CVE-2024-5599 7.5 HighJune 7, 2024
• fileorganizer, softaculous fileorganizer – wordpress file manager +1 more FileOrganizer and FileOrganizer Pro <= 1.0.6 - Authenticated Stored Cross-Site Scripting CVE-2024-2324 4.4 MediumMay 2, 2024
• pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 more Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes CVE-2024-2504 6.4 MediumApril 9, 2024
• softaculous backuply – backup, restore, migrate and clone Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal CVE-2024-2294 4.9 MediumMarch 16, 2024
• pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 more Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes CVE-2024-2127 6.4 MediumMarch 7, 2024
• pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 more Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button CVE-2024-1590 4.6 MediumFebruary 23, 2024
• softaculous backuply, backuply – backup, restore, migrate and clone +1 more Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service CVE-2024-0842 7.5 HighFebruary 9, 2024
• ampps AMPPS Encryption Passphrase denial of service CVE-2024-1189 5.3 MediumFebruary 2, 2024
• softaculous backuply, backuply – backup, restore, migrate and clone +1 more Backuply – Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory Traversal CVE-2024-0697 6.5 MediumJanuary 27, 2024
• softaculous speedycache, speedycache – cache, optimization, performance +1 more SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update CVE-2023-6598 4.3 MediumJanuary 11, 2024
• pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 more PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields CVE-2023-6738 5.4 MediumJanuary 4, 2024
• softaculous speedycache, speedycache – cache, optimization, performance +1 more WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF) CVE-2023-49746 4.9 MediumDecember 7, 2023
• loginizer Loginizer 1.7.8 - Reflected XSS CVE-2023-2296 6.1 MediumMay 30, 2023
• Show olderLoading…