Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Kingcomposer - Security Vulnerability (CVE-2020-36701)
The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_action' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level permissions and above to upload arbitrary files onto the server which can be used to execute code on the server.
PLUGIN
Kingcomposer
CVE-2020-36701
Risk Score
Threat Entry
Updated 2026-06-17
Kingcomposer - Broken Access Control (CVE-2020-36700)
The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content.
PLUGIN
Kingcomposer
CVE-2020-36700
Risk Score
Threat Entry
Updated 2026-06-17
Kingcomposer - Cross-Site Scripting (XSS) (CVE-2021-25048)
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
PLUGIN
Kingcomposer
CVE-2021-25048
Risk Score
Threat Entry
Updated 2026-06-17
Kingcomposer - Improper Input Validation (CVE-2022-0165)
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
PLUGIN
Kingcomposer
CVE-2022-0165
Risk Score
Threat Entry
Updated 2026-06-17
Kingcomposer - Cross-Site Scripting (XSS) (CVE-2020-15299)
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.
PLUGIN
Kingcomposer
CVE-2020-15299
Risk Score
Threat Entry
Updated 2026-06-17
Kingcomposer - Cross-Site Scripting (XSS) (CVE-2019-9910)
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.
PLUGIN
Kingcomposer
CVE-2019-9910
Risk Score