Taskbuilder (Taskbuilder) - vulnerabilities (CVEs)

6 CVEs, 1 in the last 30 days, 32 known versions, newest CVE from 2026-10-09. Vendor: Taskbuilder.

CVEs of Taskbuilder

CVE-2026-95599 - CVSS 8.5 (high), 2026-10-09: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL…
CVE-2026-52697 - CVSS 8.5 (high), 2026-06-15: Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.
CVE-2025-67933 - CVSS 7.1 (high), 2026-01-08: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected…
CVE-2025-30945 - CVSS 5.3 (medium), 2025-06-06: Missing Authorization vulnerability in taskbuilder Taskbuilder taskbuilder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects…
CVE-2024-9831 - CVSS 7.2 (high), 2025-05-15: The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL…
CVE-2025-39569 - CVSS 8.5 (high), 2025-04-17: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows Blind SQL…
CVE-2025-22716 - CVSS 8.8 (high), 2025-01-21: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL…
CVE-2024-11930 - CVSS 6.4 (medium), 2025-01-04: The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks…
CVE-2024-9828 - CVSS 4.1 (medium), 2024-11-21: The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high…
CVE-2022-3137 - CVSS 5.4 (medium), 2022-10-10: The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber)…