WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
buddypress-media
Published
2024-04-29
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.19 - Subscriber+ SQL Injection
Slug
buddypress-media
Published
2025-12-12
Title
rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
Slug
buddypress-media
Published
2026-04-21
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.10 - Missing Authorization
Slug
buddypress-media
Published
2026-02-01
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.9 - Unauthenticated Information Exposure
Slug
buddypress-media
Published
2026-07-23
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.11 - Authenticated (Subscriber+) SQL Injection
Slug
buddypress-media
Published
2026-07-23
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.11 - Unauthenticated SQL Injection
Slug
buddypress-media
Published
2026-08-19
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Unauthenticated SQL Injection
Slug
buddypress-members-only
Published
2024-06-05
Title
BuddyPress Members Only < 3.4.9 - Improper Access Control to Sensitive Information Exposure via REST API
Slug
buddypress-members-only
Published
2025-04-01
Title
BuddyPress Members Only < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddypress-notifications-widget
Published
2025-09-22
Title
BuddyPress Notification Widget <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddypress-profile-pro
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buddypress-sticky-post
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buddypress-xprofile-custom-fields-type
Published
2018-01-04
Title
buddypress-xprofile-custom-fields-type 2.6.3 - Authenticated Arbitrary File Deletion
Slug
buddypress-xprofile-image-field
Published
2025-07-31
Title
BuddyPress XProfile Custom Image Field < 3.1.0 - Unauthenticated Arbitrary File Deletion
Slug
buddytask
Published
2025-12-11
Title
BuddyTask < 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation
Slug
buddyvendor
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buffer-my-post
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
buffer-my-post
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
buffer-my-post
Published
2025-09-05
Title
WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule <= 2020.1.0 - Cross-Site Request Forgery
Slug
bug-library
Published
2021-09-09
Title
Bug Library < 2.0.4 - Reflected Cross-Site Scripting
Slug
bug-library
Published
2024-06-28
Title
Bug Library < 2.1.2 - Admin+ Stored XSS
Slug
bug-library
Published
2024-06-22
Title
Bug Library < 2.1.1 - Unauthenticated RCE
Slug
bug-library
Published
2025-01-24
Title
Bug Library < 2.1.5 - Authenticated (Contributor+) SQL Injection
Slug
bugsnag
Published
2025-09-05
Title
Error Monitoring by Bugsnag < 1.6.4 - Cross-Site Request Forgery
Slug
build-app-online
Published
2022-12-06
Title
Build App Online < 1.0.19 - Unauthenticated SQL Injection