Vulnerabilidades de SeaTheme
CVEs publicadas que afetam produtos de SeaTheme: 4 registro(s), com severidade, exploração e correções.
CVE-2025-1281
Alta · 8.8
CWE-22 22/09/2026
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE-2025-1280
Média · 6.5
CWE-22 22/09/2026
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVE-2025-69055
Média · 6.5
CWE-22 22/01/2026
WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
CVE-2025-59002
Alta · 7.7
CWE-22 26/09/2025
WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary File Deletion Vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.