cve.bz

themekraft buddyforms vulnerabilities in 2026, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 5.4CVE-2026-107658EPSS 0.3%

    The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output …

  2. 9.8CVE-2026-107622EPSS 0.7%

    The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission han…

  3. 6.5CVE-2026-81785EPSS 0.3%

    Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.