Vulnerabilities in bplugins
84 resultsVexday analysis
A bplugins apresenta 36 vulnerabilidades em seu histórico, com 1 crítica e 4 publicadas nos últimos 90 dias, indicando atividade contínua de descoberta de falhas. Nenhuma vulnerabilidade está sob exploração ativa conhecida (KEV), reduzindo significativamente o risco imediato. A fraqueza dominante é XSS (CWE-79), típica de componentes web, requerendo atenção em validação de entrada mas sem urgência crítica no curto prazo.
CVE-2024-23508HIGHWordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-30432MEDIUMWordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49900HIGHWordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2024-11880MEDIUMB Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-7721MEDIUMHTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateEPSS 0.3%CVE-2025-12384HIGHDocument Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document ManipulationEPSS 0.3%CVE-2025-22787MEDIUMWordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-10667MEDIUMContent Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post DisclosureEPSS 0.3%CVE-2024-10669MEDIUMCountdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post DisclosureEPSS 0.3%CVE-2026-1294HIGHAll In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy EndpointEPSS 0.3%CVE-2025-2579MEDIUMLottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-11882MEDIUMFAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-10735MEDIUMBlock For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request ForgeryEPSS 0.3%CVE-2026-39579HIGHWordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2026-24565MEDIUMWordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2024-13362MEDIUMFreemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url ParameterEPSS 0.3%CVE-2024-43148MEDIUMWordPress StreamCast <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13731MEDIUMAlert Box Block – Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box BlockEPSS 0.3%CVE-2025-26938MEDIUMWordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49394HIGHWordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerabilityEPSS 0.3%