Plugin icon

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)

buddyforms

Vulnerabilities:

19

Last Updated:

June 4, 2025

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2025-10-19
Title
BuddyForms <= 2.9.0 - Missing Authorization
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2025-04-04
Title
BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion
Fixed in
No known fix
CVSS
8.8 (high)
Published
2025-02-21
Title
Frontend Content Forms for User Submissions (UGC) < 2.8.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode
Fixed in
Fixed in 2.8.16
CVSS
6.4 (medium)
Published
2025-01-30
Title
Frontend Content Forms for User Submissions (UGC) < 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.14
CVSS
6.4 (medium)
Published
2024-09-30
Title
BuddyForms < 2.8.13 - Authenticated (Editor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.13
CVSS
4.4 (medium)
Published
2024-09-13
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.12 - Authenticated (Contributor+) Privilege Escalation
Fixed in
Fixed in 2.8.12
CVSS
8.8 (high)
Published
2024-06-04
Title
BuddyForms < 2.8.10 - Email Verification Bypass due to Insufficient Randomness
Fixed in
Fixed in 2.8.10
CVSS
6.5 (medium)
Published
2024-04-22
Title
BuddyForms < 2.8.9 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
Fixed in
Fixed in 2.8.9
CVSS
9.3 (critical)
Published
2024-03-25
Title
BuddyForms < 2.8.6 - Reflected Cross-Site Scripting via page
Fixed in
Fixed in 2.8.6
CVSS
6.1 (medium)
Published
2024-03-06
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.8 - Missing Authorization to Unauthenticated Media Deletion
Fixed in
Fixed in 2.8.8
CVSS
8.2 (high)
Published
2024-03-06
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.8 - Missing Authorization
Fixed in
Fixed in 2.8.8
CVSS
4.3 (medium)
Published
2024-03-06
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.8 - Missing Authorization to Unauthenticated Media Upload
Fixed in
Fixed in 2.8.8
CVSS
7.5 (high)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.8.3
CVSS
6.1 (medium)
Published
2023-05-11
Title
BuddyForms < 2.8.2 - Contributor+ Stored XSS
Fixed in
Fixed in 2.8.2
CVSS
5.9 (medium)
Published
2023-02-23
Title
BuddyForms < 2.7.8 - Unauthenticated PHAR Deserialization
Fixed in
Fixed in 2.7.8
CVSS
8.1 (high)
Published
2022-10-27
Title
BuddyForms < 2.7.6 - Contributor+ Stored XSS
Fixed in
Fixed in 2.7.6
CVSS
6.8 (medium)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 2.6.3
CVSS
4.3 (medium)
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Fixed in
Fixed in 2.3.2
CVSS
9.9 (critical)
Published
2018-11-09
Title
Buddyforms < 2.2.8 - SQL Injection
Fixed in
Fixed in 2.2.8
CVSS
9.8 (critical)