softaculous vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 202418
3. 202512
4. 202613

Newest CVEs

• CVE-2026-96768

  GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body

  softaculous · GoSMTP Pro

  High7.2
• CVE-2026-93953

  Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation

  softaculous · Backuply – Backup, Restore, Migrate and Clone

  High8.0
• CVE-2026-104006

  SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check

  softaculous · SpeedyCache – Cache, Optimization, Performance

  Low3.7
• CVE-2026-43643

  Softaculous Virtualizor Authorization Bypass via Billing Module Handler

  Softaculous · Virtualizor

  High8.7
• CVE-2026-43642

  Softaculous Virtualizor PHP Object Injection via Billing Module Handler

  Softaculous · Virtualizor

  Critical9.2
• CVE-2026-43641

  Softaculous Virtualizor OS Command Injection via Billing Module Handler

  Softaculous · Virtualizor

  Critical9.3
• CVE-2026-5114

  SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read

  softaculous · SpeedyCache – Cache, Optimization, Performance

  Medium4.9
• CVE-2026-59519

  WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability

  Softaculous · FormLayer

  Medium5.3
• CVE-2026-2470

  Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'

  softaculous · Page Builder: Pagelayer – Drag and Drop website builder

  Medium4.3
• CVE-2026-3297

  Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

  softaculous · Page Builder: Pagelayer – Drag and Drop website builder

  Medium6.4