Skip to content
OpenAdvisories

Product · SeaTheme

BM Content Builder

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2025-1281

    BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion

    The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it…

    SeaTheme BM Content Builder Web / CMS
  • High 7.7
    CVE-2025-59002

    WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary File Deletion Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.

    SeaTheme BM Content Builder
  • High 8.8
    CVE-2025-1279

    BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

    The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ux_cb_tools_import_item_ajax AJAX action in all versions up to, and including, 3.16.2…

    SeaTheme BM Content Builder Web / CMS