WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bubble-menu
Published
2023-01-20
Title
Bubble Menu - Circle Floating Menu < 3.0.2 - Form Deletion via CSRF
Slug
bubble-menu
Published
2023-05-22
Title
Multiple Plugins from Wow-Company - Reflected XSS
Slug
bubble-menu
Published
2023-07-17
Title
Bubble Menu < 3.0.5 - Admin+ Stored XSS
Slug
bubble-menu
Published
2025-01-24
Title
Bubble Menu – circle floating menu < 4.0.3 - Cross-Site Request Forgery
Slug
buckets
Published
2014-08-01
Title
buckets <= 0.1.9.2 - XSS in ZeroClipboard
Slug
buckets
Published
2025-09-22
Title
Buckets <= 0.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddy-press-force-password-change
Published
2025-04-23
Title
Buddypress Force Password Change <= 0.1 - Subscriber+ Account Takeover via Password Update
Slug
buddybadges
Published
2022-11-17
Title
Buddybadges <= 1.0.0 - Admin+ SQLi
Slug
buddyboss-media
Published
2018-01-17
Title
BuddyBoss Media <= 3.2.3 - Stored XSS
Slug
buddyboss-platform
Published
2021-09-16
Title
Buddyboss Platform < 1.7.9 - Subscriber+ SQL Injection
Slug
buddyboss-platform
Published
2024-05-14
Title
BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment
Slug
buddyboss-platform
Published
2024-04-22
Title
BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR
Slug
buddyboss-platform
Published
2025-02-26
Title
BuddyBoss Platform < 2.8.00 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'
Slug
buddyboss-platform
Published
2025-05-01
Title
BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'
Slug
buddyboss-platform
Published
2025-05-01
Title
BuddyBoss Platform < 2.8.51 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'
Slug
buddyboss-platform
Published
2025-05-01
Title
BuddyBoss Platform < 2.8.51 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function
Slug
buddyboss-platform-pro
Published
2025-05-05
Title
BuddyBoss Platform Pro < 2.7.10 - Authentication Bypass via Apple OAuth provider
Slug
buddydrive
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
buddyforms
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
buddyforms
Published
2018-11-09
Title
Buddyforms < 2.2.8 - SQL Injection
Slug
buddyforms
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
buddyforms
Published
2023-02-23
Title
BuddyForms < 2.7.8 - Unauthenticated PHAR Deserialization
Slug
buddyforms
Published
2022-10-27
Title
BuddyForms < 2.7.6 - Contributor+ Stored XSS
Slug
buddyforms
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
buddyforms
Published
2023-05-11
Title
BuddyForms < 2.8.2 - Contributor+ Stored XSS