Villatheme Bopo – Woocommerce Product Bundle Builder vulnerabilities

2 CVEs affecting Villatheme Bopo – Woocommerce Product Bundle Builder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57422, published 2026-07-13.

More from Villatheme.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-57664, published 2026-06-26. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.
• CVE-2026-57422, published 2026-07-13. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows…