Threat Database

Threat Entry Updated 2026-09-21

Nimble Page Builder - Security Vulnerability (CVE-2026-16557)

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.

PLUGIN Nimble Page Builder

CVE-2026-16557

MEDIUM CVSS 4.3 2026-09-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Nimble Page Builder - Cross-Site Scripting (XSS) (CVE-2022-0314)

The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

PLUGIN Nimble Page Builder

CVE-2022-0314

MEDIUM CVSS 6.1 2022-04-11

Risk Score

Open Full Technical Breakdown