BoldGrid vulnerabilities
We track 18 vulnerabilities in BoldGrid products across 8 products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2026.
Latest BoldGrid vulnerabilities
- 7.2 High severity
W3 Total Cache: Improper Neutralization of Input During Web Page Generation
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated
- 7.2 High severity
W3 Total Cache: Improper Neutralization of Input During Web Page Generation
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it poss
- 7.2 High severity
W3 Total Cache: Improper Neutralization of Input During Web Page Generation
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it poss
- 7.2 High severity
W3 Total Cache: Improper Neutralization of Input During Web Page Generation
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att
- 7.5 High severity
W3 Total Cache: Improper Limitation of a Pathname to a Restricted Directory
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server,
- 7.5 High severity
W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor
The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3
- 8.8 High severity
weForms: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.
- 7.2 High severity
Client Invoicing by Sprout Invoices: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client Invoicing by Sprout
- 9.0 Critical severity
W3 Total Cache: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through <= 2.9.1.
- 7.1 High severity
Sprout Clients: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through <= 3.2.1.
- 9.8 Critical severity
Client Invoicing by Sprout Invoices: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- 7.2 High severity
Total Upkeep – WordPress Backup Plugin plus…: Improper Neutralization of Special Elements used in an OS Command
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compr
- 8.5 High severity
W3 Total Cache: Missing Authorization
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subs
- 7.5 High severity
W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor
The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive informatio
- 7.2 High severity
Total Upkeep – WordPress Backup Plugin plus…: Improper Neutralization of Special Elements used in an OS Command
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and
- 7.5 High severity
W3 Total Cache: Cleartext Storage of Sensitive Information
The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to
- 7.5 High severity
Total Upkeep: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep allows Relative Path Traversal.This issue affects Total Upkeep: from n/a through 1.15.8.
- 8.8 High severity
Post and Page Builder by BoldGrid – Visual…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions.