WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
buddyboss-platform
Published
2025-05-01
Title
BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'
Slug
buddyboss-platform
Published
2025-05-01
Title
BuddyBoss Platform < 2.8.51 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'
Slug
buddyboss-platform
Published
2025-05-01
Title
BuddyBoss Platform < 2.8.51 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function
Slug
buddyboss-platform-pro
Published
2025-05-05
Title
BuddyBoss Platform Pro < 2.7.10 - Authentication Bypass via Apple OAuth provider
Slug
buddydrive
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
buddyforms
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
buddyforms
Published
2018-11-09
Title
Buddyforms < 2.2.8 - SQL Injection
Slug
buddyforms
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
buddyforms
Published
2023-02-23
Title
BuddyForms < 2.7.8 - Unauthenticated PHAR Deserialization
Slug
buddyforms
Published
2022-10-27
Title
BuddyForms < 2.7.6 - Contributor+ Stored XSS
Slug
buddyforms
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
buddyforms
Published
2023-05-11
Title
BuddyForms < 2.8.2 - Contributor+ Stored XSS
Slug
buddyforms
Published
2024-03-06
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.8 - Missing Authorization
Slug
buddyforms
Published
2024-03-06
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.8 - Missing Authorization to Unauthenticated Media Deletion
Slug
buddyforms
Published
2024-03-06
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.8 - Missing Authorization to Unauthenticated Media Upload
Slug
buddyforms
Published
2024-03-25
Title
BuddyForms < 2.8.6 - Reflected Cross-Site Scripting via page
Slug
buddyforms
Published
2024-04-22
Title
BuddyForms < 2.8.9 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
Slug
buddyforms
Published
2024-06-04
Title
BuddyForms < 2.8.10 - Email Verification Bypass due to Insufficient Randomness
Slug
buddyforms
Published
2024-09-13
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.12 - Authenticated (Contributor+) Privilege Escalation
Slug
buddyforms
Published
2024-09-30
Title
BuddyForms < 2.8.13 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
buddyforms
Published
2025-01-30
Title
Frontend Content Forms for User Submissions (UGC) < 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddyforms
Published
2025-02-21
Title
Frontend Content Forms for User Submissions (UGC) < 2.8.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode
Slug
buddyforms
Published
2025-04-04
Title
BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion
Slug
buddyforms
Published
2025-10-19
Title
BuddyForms <= 2.9.0 - Missing Authorization
Slug
buddyforms-acf
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting