BoldGrid Vulnerabilities and Affected Products
Vulnerabilities associated with Client Invoicing by Sprout Invoices.
Products
Clear product- W3 Total Cache14 vulnerabilities
- Client Invoicing by Sprout Invoices8 vulnerabilities
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid6 vulnerabilities
- Post and Page Builder by BoldGrid5 vulnerabilities
- Post and Page Builder by BoldGrid – Visual Drag and Drop Editor5 vulnerabilities
- Sprout Clients4 vulnerabilities
- BoldGrid Easy SEO – Simple and Effective SEO2 vulnerabilities
- Total Upkeep2 vulnerabilities
- total_upkeep2 vulnerabilities
- weForms2 vulnerabilities
- weForms – Easy Drag & Drop Contact Form Builder For WordPress2 vulnerabilities
- Help Scout1 vulnerability
- w3_total_cache1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-57418MEDIUM | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerabilityMissing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13. CWE-862Jul 13, 2026 | CVSS6.5v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39562MEDIUM | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerabilityMissing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10. CWE-862Apr 8, 2026 | CVSS5.3v3.1 | EPSS0.214% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-32401HIGH | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.9. CWE-98Mar 13, 2026 | CVSS7.2v3.1 | EPSS0.398% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-25364MEDIUM | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerabilityMissing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8. CWE-862Feb 19, 2026 | CVSS5.3v3.1 | EPSS0.214% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-64227CRITICAL | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7. CWE-502Dec 18, 2025 | CVSS9.8v3.1 | EPSS0.332% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-64229MEDIUM | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerabilityMissing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7. CWE-862Oct 29, 2025 | CVSS4.3v3.1 | EPSS0.175% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-24606MEDIUM | WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.1. CWE-862Jan 27, 2025 | CVSS6.4v3.1 | EPSS0.259% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-53819MEDIUM | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerabilityMissing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.0. CWE-862Dec 9, 2024 | CVSS5.3v3.1 | EPSS0.478% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |