WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bp-better-messages
Published
2025-12-16
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.10.3 - Unauthenticated Stored Cross-Site Scripting
Slug
bp-check-in
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
bp-code-snippets
Published
2014-08-01
Title
bp-code-snippets <= 2.0 - XSS in ZeroClipboard
Slug
bp-cover
Published
2024-06-06
Title
BuddyPress Cover <= 2.1.4.2 - Unauthenticated Arbitrary File Upload
Slug
bp-create-group-type
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
bp-direct-menus
Published
2025-09-29
Title
BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
bp-disable-activation-reloaded
Published
2025-09-22
Title
BP Disable Activation Reloaded <= 1.2.1 - Cross-Site Request Forgery
Slug
bp-email-assign-templates
Published
2024-12-11
Title
BP Email Assign Templates < 1.6 - Reflected XSS
Slug
bp-email-assign-templates
Published
2025-03-11
Title
BP Email Assign Templates < 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
bp-email-assign-templates
Published
2025-03-11
Title
BP Email Assign Templates <= 1.6 - Missing Authorization to Authorization Bypass
Slug
bp-gallery
Published
2014-08-01
Title
bp-gallery 1.2.5 - Cross Site Scripting
Slug
bp-greeting-message
Published
2024-10-21
Title
BuddyPress Greeting Message <= 1.0.3 - Reflected Cross-Site Scripting
Slug
bp-group-documents
Published
2014-08-01
Title
Group Documents 1.2.1 - Document Upload Multiple Field Stored XSS
Slug
bp-group-documents
Published
2014-08-01
Title
Group Documents 1.2.1 - bp-group-documents-settings.php file Parameter Remote Path Traversal File Location Manipulation
Slug
bp-group-documents
Published
2014-08-01
Title
Group Documents 1.2.1 - Document Property Manipulation CSRF
Slug
bp-group-documents
Published
2014-08-01
Title
Group Documents 1.2 - File Uploading Multiple Parameter Stored XSS
Slug
bp-job-manager
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
bp-member-type-manager
Published
2024-10-21
Title
BP Member Type Manager <= 1.01 - Reflected Cross-Site Scripting
Slug
bp-messages-tool
Published
2025-04-29
Title
BP Messages Tool < 2.5 - Reflected Cross-Site Scripting
Slug
bp-profile-as-homepage
Published
2025-06-05
Title
BP Profile as Homepage <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
bp-profile-search
Published
2016-12-09
Title
BP Profile Search < 4.6 - PHP Object Injection
Slug
bp-profile-search
Published
2024-01-17
Title
BP Profile Search < 5.6 - Reflected Cross-Site Scripting via BPS_FORM
Slug
bp-profile-search
Published
2024-08-19
Title
BP Profile Search < 5.8 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Slug
bp-profile-shortcodes-extra
Published
2023-11-15
Title
BP Profile Shortcodes Extra < 2.5.3 - Contributor+ Stored XSS
Slug
bp-profile-shortcodes-extra
Published
2024-12-02
Title
BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter