Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?page-builder-addClassic Addons – WPBakery Page Builder
Plugin · page-builder-add
page-builder-add
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 16, 2026Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages: Cross-Site Request ForgeryCVE-2026-12409 · affects up to 1.5.3.6 · reported by WordfenceMedium 4.3
The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb_admin_ajax function. This makes it possible for unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This attack requires the victim to hold an editor-level or administrator session, as the wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 29, 2026Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions.CVE-2026-57337 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions.
Jan 23, 2026Landing Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24620 · affects up to 1.5.3.4 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder page-builder-add allows Stored XSS.This issue affects Landing Page Builder: from n/a through <= 1.5.3.4.
Aug 19, 2024Landing Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43345 · affects up to 1.5.2.0 · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0.
May 17, 2024Landing Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34752 · affects up to 1.5.1.8 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Reflected XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.8.
Mar 29, 2024Landing Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30452 · affects up to 1.5.1.7 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Stored XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.7.
Dec 7, 2023Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-48325 · affects up to 1.5.1.5 · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5.
Sep 27, 2023Auth.CVE-2023-40675 · affects up to 1.5.1.2 · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps Landing Page Builder plugin <= 1.5.1.2 versions.
Jan 23, 2023Landing Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4718 · fixed in 1.4.9.9 · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Jan 17, 2022Landing Page Builder: Was affected by a reflected XSS in page-builder-add on the ulpb_post admin pageCVE-2021-25067 · fixed in 1.4.9.6 · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.