Seatheme Bm Content Builder vulnerabilities

CVE-2025-1279 [HIGH] CWE-862 CVE-2025-1279: The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ux_cb_tools_import_item_ajax AJAX action in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t

CVE-2025-59002 [HIGH] CWE-22 CVE-2025-59002: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaT Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.

CVE-2025-69055 [MEDIUM] CWE-22 CVE-2025-69055: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaT Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.

CVE-2025-1777 [MEDIUM] CWE-862 CVE-2025-1777: The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that w