SeaTheme vulnerabilities
We track 3 vulnerabilities in SeaTheme products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest SeaTheme vulnerabilities
- 8.8 High severity
BM Content Builder: Improper Limitation of a Pathname to a Restricted Directory
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it
- 7.7 High severity
BM Content Builder: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
- 8.8 High severity
BM Content Builder: Missing Authorization
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ux_cb_tools_import_item_ajax AJAX action in all versions up to, and including, 3.16.2.