WordPress plugin
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High4
- Medium4
- Low0
All Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.5 | Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting ≤2.9.6No patch available | CVE-2021-25048 | |
| High8.8 | Open Redirect ≤2.9.6No patch available | CVE-2022-0165 | |
| Medium5.5 | Stored Cross-Site Scripting <2.9.4Update to 2.9.4 | CVE-2020-36709 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.9.4Update to 2.9.5 | CVE-2020-15299 | |
| High8.8 | Authorization Bypass due to Improper Access Control ≤2.9.3Update to 2.9.4 | CVE-2020-36700 | |
| High8.8 | Arbitrary File Upload ≤2.9.3Update to 2.9.4 | CVE-2020-36701 | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting <2.8.2Update to 2.8.2 | — | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.8Update to 2.8.1 | CVE-2019-9910 |
- High8.5Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting
≤2.9.6No patch available
- High8.8Open Redirect
≤2.9.6No patch available
- Medium5.5Stored Cross-Site Scripting
<2.9.4Update to 2.9.4
- Medium6.1Reflected Cross-Site Scripting
≤2.9.4Update to 2.9.5
- High8.8Authorization Bypass due to Improper Access Control
≤2.9.3Update to 2.9.4
- High8.8Arbitrary File Upload
≤2.9.3Update to 2.9.4
- Medium6.4Authenticated Stored Cross-Site Scripting
<2.8.2Update to 2.8.2
- Medium6.1Reflected Cross-Site Scripting
≤2.8Update to 2.8.1
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme: common questions
Does Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme: 4 high, 4 medium. At least one is not fixed in the latest version.
How do I check which version of Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme vulnerability?
CVE-2021-25048, published Mar 14, 2022: Page Builder KingComposer <= 2.9.6 - Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting. Severity: High (CVSS 8.5).
Is any Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme vulnerability listed in CISA KEV?
No. None of the known Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme vulnerabilities is currently listed in the CISA KEV catalog.