WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
buddypress-media
Published
2016-01-28
Title
trMedia for WordPress <= 3.10.1 - XSS
Slug
buddypress-media
Published
2016-12-21
Title
trMedia for WordPress <= 4.2 - Unspecified Issues
Slug
buddypress-media
Published
2023-09-06
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization via export_settings
Slug
buddypress-media
Published
2023-09-04
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Settings Update
Slug
buddypress-media
Published
2023-09-04
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Sensitive Information Exposure
Slug
buddypress-media
Published
2023-11-29
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE
Slug
buddypress-media
Published
2023-11-29
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCE
Slug
buddypress-media
Published
2024-04-22
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.19 - Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode
Slug
buddypress-media
Published
2024-04-29
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.19 - Subscriber+ SQL Injection
Slug
buddypress-media
Published
2025-12-12
Title
rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
Slug
buddypress-members-only
Published
2024-06-05
Title
BuddyPress Members Only < 3.4.9 - Improper Access Control to Sensitive Information Exposure via REST API
Slug
buddypress-members-only
Published
2025-04-01
Title
BuddyPress Members Only < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddypress-notifications-widget
Published
2025-09-22
Title
BuddyPress Notification Widget <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddypress-profile-pro
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buddypress-sticky-post
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buddypress-xprofile-custom-fields-type
Published
2018-01-04
Title
buddypress-xprofile-custom-fields-type 2.6.3 - Authenticated Arbitrary File Deletion
Slug
buddypress-xprofile-image-field
Published
2025-07-31
Title
BuddyPress XProfile Custom Image Field < 3.1.0 - Unauthenticated Arbitrary File Deletion
Slug
buddytask
Published
2025-12-11
Title
BuddyTask < 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation
Slug
buddyvendor
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buffer-my-post
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
buffer-my-post
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
buffer-my-post
Published
2025-09-05
Title
WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule <= 2020.1.0 - Cross-Site Request Forgery
Slug
bug-library
Published
2021-09-09
Title
Bug Library < 2.0.4 - Reflected Cross-Site Scripting
Slug
bug-library
Published
2024-06-28
Title
Bug Library < 2.1.2 - Admin+ Stored XSS
Slug
bug-library
Published
2024-06-22
Title
Bug Library < 2.1.1 - Unauthenticated RCE