WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bp-profile-shortcodes-extra
Published
2025-01-07
Title
BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
bp-restrict
Published
2025-11-17
Title
Restrictions for BuddyPress < 1.5.3 - Missing Authorization to Unauthenticated Tracking Status Update
Slug
bp-social-connect
Published
2023-05-18
Title
BP Social Connect < 1.6.2 - Authentication Bypass
Slug
bp-social-connect
Published
2025-04-09
Title
BP Social Connect <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
bp-toolkit
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
bp-toolkit
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
bp-user-profile-reviews
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
bp-user-to-do-list
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
bp-wc-vendors
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
bp-wc-vendors
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
bp-xprofile-custom-field-types
Published
2026-01-05
Title
BuddyPress Xprofile Custom Field Types < 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
bpcustomerio
Published
2021-06-30
Title
BuddyPress Customer.io Analytics Integration <= 1.1.6 - Arbitrary Plugin Settings Update via CSRF
Slug
bpmnio
Published
2024-10-31
Title
bpmn.io <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
bradesco-gateway
Published
2014-08-01
Title
Bradesco - falha.php URI Reflected XSS
Slug
bradmax-player
Published
2024-07-10
Title
Bradmax Player < 1.1.28 - Contributor+ Stored XSS
Slug
brand-my-footer
Published
2024-11-08
Title
Brand my Footer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
branda-white-labeling
Published
2023-12-27
Title
Branda < 3.4.15 - IP Spoofing
Slug
branda-white-labeling
Published
2024-06-20
Title
Branda – White Label WordPress, Custom Login Page Customizer < 3.4.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
Slug
branda-white-labeling
Published
2024-06-28
Title
Branda < 3.4.18 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
branda-white-labeling
Published
2024-07-10
Title
Branda – White Label WordPress, Custom Login Page Customizer < 3.4.19 - Unauthenticated Full Path Disclosure
Slug
branda-white-labeling
Published
2024-11-20
Title
Branda – White Label & Branding, Custom Login Page Customizer < 3.4.22 - Reflected Cross-Site Scripting
Slug
branda-white-labeling
Published
2026-01-01
Title
Branda – White Label & Branding, Free Login Page Customizer < 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
Slug
brandfolder
Published
2016-03-23
Title
Brandfolder <= 3.0 - File Inclusion
Slug
brandfolder
Published
2025-07-15
Title
Brandfolder < 5.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Slug
branding
Published
2024-10-17
Title
Branding <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload