Themekraft Buddyforms vulnerabilities

• themekraft buddyforms BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion CVE-2026-107658 5.4 MediumNovember 6, 2026
• themekraft buddyforms BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter CVE-2026-107622 9.8 CriticalNovember 6, 2026
• themekraft buddyforms BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion CVE-2026-118437 3.7 LowOctober 31, 2026
• themekraft buddyforms BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification CVE-2026-118101 5.3 MediumOctober 30, 2026
• themekraft buddyforms BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure CVE-2026-118100 5.3 MediumOctober 30, 2026
• themekraft buddyforms WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability CVE-2026-81785 6.5 MediumSeptember 10, 2026
• themekraft buddyforms WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability CVE-2025-62973 5.3 MediumOctober 27, 2025
• themekraft buddyforms WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability CVE-2025-32151 7.5 HighApril 4, 2025
• svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft buddyforms +1 more Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode CVE-2024-12038 6.4 MediumFebruary 22, 2025
• themekraft buddyforms WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability CVE-2024-47377 5.9 MediumOctober 5, 2024
• svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft buddyforms, post form registration form profile form for user profiles and content forms +2 more Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation CVE-2024-8246 8.8 HighSeptember 14, 2024
• themekraft buddyforms, svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft post form registration form profile form for user profiles and content forms +2 more BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness CVE-2024-5149 6.5 MediumJune 5, 2024
• themekraft buddyforms WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability CVE-2024-32830 Public exploit 8.6 HighMay 17, 2024
• themekraft buddyforms WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-30198 5.8 MediumMarch 27, 2024
• svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft buddyforms +1 more Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization CVE-2024-1158 4.3 MediumMarch 13, 2024
• themekraft buddyforms The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated... CVE-2023-26326 Public exploit 9.8 CriticalFebruary 23, 2023
• themekraft buddyforms The buddyforms plugin before 2.2.8 for WordPress has SQL injection. CVE-2018-21003 9.8 CriticalAugust 27, 2019