WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
buddypress-media
Published
2026-09-11
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Unauthenticated SQL Injection via 'compare' Parameter
Slug
buddypress-media
Published
2026-10-09
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
Slug
buddypress-media
Published
2026-10-08
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Unauthenticated Arbitrary File Deletion
Slug
buddypress-media
Published
2026-10-12
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
Slug
buddypress-members-only
Published
2024-06-05
Title
BuddyPress Members Only < 3.4.9 - Improper Access Control to Sensitive Information Exposure via REST API
Slug
buddypress-members-only
Published
2025-04-01
Title
BuddyPress Members Only < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddypress-notifications-widget
Published
2025-09-22
Title
BuddyPress Notification Widget <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
buddypress-profile-pro
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buddypress-sticky-post
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buddypress-xprofile-custom-fields-type
Published
2018-01-04
Title
buddypress-xprofile-custom-fields-type 2.6.3 - Authenticated Arbitrary File Deletion
Slug
buddypress-xprofile-image-field
Published
2025-07-31
Title
BuddyPress XProfile Custom Image Field < 3.1.0 - Unauthenticated Arbitrary File Deletion
Slug
buddypress-xprofile-image-field
Published
2026-10-13
Title
BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
Slug
buddytask
Published
2025-12-11
Title
BuddyTask < 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation
Slug
buddyvendor
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
buffer-my-post
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
buffer-my-post
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
buffer-my-post
Published
2025-09-05
Title
WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule <= 2020.1.0 - Cross-Site Request Forgery
Slug
bug-library
Published
2021-09-09
Title
Bug Library < 2.0.4 - Reflected Cross-Site Scripting
Slug
bug-library
Published
2024-06-28
Title
Bug Library < 2.1.2 - Admin+ Stored XSS
Slug
bug-library
Published
2024-06-22
Title
Bug Library < 2.1.1 - Unauthenticated RCE
Slug
bug-library
Published
2025-01-24
Title
Bug Library < 2.1.5 - Authenticated (Contributor+) SQL Injection
Slug
bugsnag
Published
2025-09-05
Title
Error Monitoring by Bugsnag < 1.6.4 - Cross-Site Request Forgery
Slug
build-app-online
Published
2022-12-06
Title
Build App Online < 1.0.19 - Unauthenticated SQL Injection
Slug
build-app-online
Published
2023-12-27
Title
Build App Online < 1.0.21 - Subscriber+ Privilege Escalation
Slug
build-app-online
Published
2023-12-27
Title
Build App Online < 1.0.22 - Unauthenticated Account Takeover via Weak Password Reset Mechanism