Bricks Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:bricks:bricks_builder:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Bricks (7d2215ba-950e-591a-ae63-7f356742ac9e) |
|---|---|
| Product | Bricks Builder (2b3c10a3-53f5-55df-8f6e-7a24561470f9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-118804 |
vulnerable | 2026-11-03 10:17:04.396426 |
Bricks Broken Access Control via query_result Endpoint
HIGH (7.5)
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
Published: 2026-10-28T21:18:28.475Z
Updated: 2026-10-29T17:21:35.958Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41554 |
vulnerable | 2026-06-08 08:03:15.552704 |
WordPress Bricks Builder theme 1.9.2-2.2 - Cross Site Scripting (XSS) vulnerability
HIGH (7.1)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS.
This issue affects Bricks Builder: from n/a through 1.9.2 to 2.2.
Published: 2026-05-07T13:28:59.279Z
Updated: 2026-05-07T15:56:58.903Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.