Bplugins
80 CVEs across 79 Bplugins products. Browse Bplugins vulnerabilities, severities, and proof-of-concept exploits.
Bplugins products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5626 | Medium | 4.3 | 2026-07-29 | The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all… |
CVE-2026-27422 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions. |
CVE-2026-57647 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions. |
CVE-2026-57323 | Medium | 5.8 | 2026-06-26 | Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions. |
CVE-2026-56063 | High | 8.3 | 2026-06-26 | Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions. |
CVE-2026-11402 | Medium | 6.4 | 2026-06-18 | The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Att… |
CVE-2026-39579 | High | 8.8 | 2026-06-15 | Contributor Privilege Escalation in B Blocks <= 2.0.31 versions. |
CVE-2026-53736 | Medium | 4.3 | 2026-06-10 | Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attack… |
CVE-2026-24520 | Medium | 4.3 | 2026-05-26 | Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok… |
CVE-2026-27416 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Pos… |
CVE-2026-6446 | Medium | 5.4 | 2026-05-02 | The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via… |
CVE-2024-13362 | Medium | 6.1 | 2026-05-01 | Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient inp… |
CVE-2026-40729 | Medium | 4.3 | 2026-04-15 | Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-32489 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B… |
CVE-2026-4120 | Medium | 6.4 | 2026-03-19 | The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Inf… |
CVE-2026-32416 | Medium | 5.4 | 2026-03-13 | Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-32359 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XS… |
CVE-2026-1228 | Medium | 4.3 | 2026-02-06 | The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Re… |
CVE-2026-1294 | High | 7.2 | 2026-02-05 | The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing… |
CVE-2026-1389 | Medium | 4.3 | 2026-01-28 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to… |
CVE-2026-24565 | Medium | 6.5 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-24383 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issu… |
CVE-2026-0833 | Medium | 6.4 | 2026-01-17 | The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due… |
CVE-2025-13999 | High | 7.2 | 2025-12-19 | The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions fro… |
CVE-2025-60079 | High | 7.1 | 2025-12-18 | Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This is… |
CVE-2025-66110 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-12376 | Medium | 6.4 | 2025-11-18 | The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and incl… |
CVE-2025-54711 | High | 7.1 | 2025-11-06 | Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info C… |
CVE-2025-49900 | High | 8.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollba… |
CVE-2025-49394 | High | 7.1 | 2025-11-06 | Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functiona… |
CVE-2025-12388 | Medium | 6.4 | 2025-11-05 | The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including… |
CVE-2025-12384 | High | 8.6 | 2025-11-05 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all ver… |
CVE-2025-62007 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a… |
CVE-2025-10735 | Medium | 4.0 | 2025-10-01 | The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and in… |
CVE-2025-9203 | Medium | 6.4 | 2025-09-17 | The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_art… |
CVE-2025-54734 | Medium | 5.8 | 2025-08-28 | Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B… |
CVE-2025-54710 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ti… |
CVE-2025-8680 | Medium | 4.3 | 2025-08-15 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the… |
CVE-2025-8676 | Medium | 4.3 | 2025-08-15 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via… |
CVE-2025-54708 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issu… |
CVE-2025-54694 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n… |
CVE-2025-8418 | High | 8.8 | 2025-08-12 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. T… |
CVE-2025-8059 | Critical | 9.8 | 2025-08-12 | The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration… |
CVE-2025-54051 | Medium | 6.5 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS… |
CVE-2025-27326 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows S… |
CVE-2025-2579 | Medium | 6.4 | 2025-04-24 | The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insuffi… |
CVE-2025-39524 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS… |
CVE-2025-32173 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue a… |
CVE-2024-13731 | Medium | 6.4 | 2025-03-25 | The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box bloc… |
CVE-2025-26952 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block business-card-block allows S… |
CVE-2025-26949 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XS… |
CVE-2025-26947 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows S… |
CVE-2025-26945 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This iss… |
CVE-2025-26939 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS… |
CVE-2025-26938 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS… |
CVE-2025-26937 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XS… |
CVE-2025-26881 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored X… |
CVE-2025-26883 | Medium | 6.5 | 2025-02-24 | Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-26754 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Store… |
CVE-2025-22675 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the f… |
CVE-2024-13514 | Medium | 4.3 | 2025-02-04 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb… |
CVE-2025-24595 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-fo… |
CVE-2025-22787 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bu… |
CVE-2024-13156 | Medium | 6.4 | 2025-01-14 | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parame… |
CVE-2025-22815 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This… |
CVE-2024-12560 | Medium | 4.3 | 2024-12-19 | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-11882 | Medium | 6.4 | 2024-12-12 | The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fa… |
CVE-2024-11880 | Medium | 6.4 | 2024-12-04 | The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in a… |
CVE-2024-10666 | Medium | 4.3 | 2024-11-22 | The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via… |
CVE-2024-10671 | Medium | 4.3 | 2024-11-21 | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and incl… |
CVE-2024-10669 | Medium | 4.3 | 2024-11-09 | The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i… |
CVE-2024-10667 | Medium | 4.3 | 2024-11-09 | The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to… |
CVE-2024-43296 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2022-4974 | Medium | 6.3 | 2024-10-16 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to… |
CVE-2024-47631 | Medium | 6.5 | 2024-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP res… |
CVE-2024-7727 | Medium | 5.3 | 2024-09-11 | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2024-7721 | Medium | 4.3 | 2024-09-11 | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-43148 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins StreamCast allows Stored XSS.This issue a… |
CVE-2024-37445 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player allows Stored XSS.This… |
CVE-2024-5522 | Medium | 6.5 | 2024-06-20 | The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing… |
CVE-2024-4398 | Medium | 6.4 | 2024-05-14 | The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all ve… |
CVE-2024-0908 | Medium | 5.3 | 2024-05-02 | The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing… |
CVE-2024-30438 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue af… |
CVE-2024-30432 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows S… |
CVE-2024-24714 | High | 7.2 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4. |
CVE-2024-23508 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress a… |
CVE-2024-1061 | High | 8.6 | 2024-01-30 | The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_vi… |
CVE-2023-6485 | Medium | 5.4 | 2024-01-01 | The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks a… |
CVE-2023-46084 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This… |
CVE-2023-5860 | High | 7.2 | 2023-11-02 | The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions u… |
CVE-2023-0170 | Medium | 5.4 | 2023-02-06 | The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2021-24868 | Medium | 4.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate… |
CVE-2021-24775 | Medium | 5.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary priva… |
CVE-2021-24416 | Medium | 5.4 | 2021-10-18 | The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as… |
CVE-2021-24415 | Medium | 5.4 | 2021-10-18 | The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allo… |
CVE-2021-24413 | Medium | 5.4 | 2021-10-18 | The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contrib… |
CVE-2021-24412 | Medium | 5.4 | 2021-10-18 | The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a… |