Skip to content
OpenAdvisories

Vendor

bPlugins

114 known vulnerabilities.

bPlugins at a glance

Last 12 months
53
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 13 25 December 2025: 2 vulnerabilities Dec 2025 January 2026: 4 vulnerabilities February 2026: 2 vulnerabilities March 2026: 4 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 4 vulnerabilities June 2026: 6 vulnerabilities Jun July 2026: 2 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 25 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 2026250
Sep 202600
Aug 202600
Jul 202620
Jun 202660
May 202640
Apr 202610
Mar 202640
Feb 202620
Jan 202640
Dec 202520
Nov 202570
Oct 202520
Sep 202510
Aug 202581
Jul 202520
Jun 202500
May 202500
Apr 202530
Mar 202510
Feb 2025120
Jan 202540
Dec 202430

Products

B Blocks 5 Flash & HTML5 Video 5 bSlider – Create Responsive Image, Post, Product, and Video Sliders 4 Button Block 4 Html5 Audio Player 3 HTML5 Video Player – Embed and Play Videos in Custom Player 3 PDF Poster 3 B Slider 3 Tiktok Feed 3 StreamCast 3 Button Block – Design Stylish, Interactive, and Multi-Functional Buttons 2 Icon List Block 2 Panorama Viewer – 360 Degree Image + Video Viewer 2 Video Gallery Block 2 HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2 Info Cards 2 bBlocks – Essential Gutenberg Blocks & Patterns Collection 2 Image Gallery block – Create and display photo gallery/photo album. 2 LightBox Block 2 Before After Image Comparison – Image comparison for WP 2 Icons Font Loader 2 Parallax Section block 2 Document Embedder – Embed PDFs, Word, Excel, and Other Files 2 Team Section Block 2 Print Page block 1 Team Section Block – Showcase Team Members with Layout Options 1 Advanced scrollbar 1 Document Embedder – let visitors read files without downloading 1 Countdown Timer 1 Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters 1 Carousel Block – Responsive Image and Content Carousel 1 Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) 1 Logo Carousel – Clients logo carousel for WP 1 Media Player Addons for Elementor – Media Player widget for WP 1 Sticky Content 1 Alert Box Block – Display Custom Alerts and Messages 1 Typing Text – Give your texts many typing effects 1 MailChimp Block 1 Alert Box Block – Display notice/alerts in the front end 1 Icon List Block – Add Icon-Based Lists with Custom Styles 1
All Critical High Medium Low Exploited only Public exploit

114 results · Feed

  • Medium 6.5
    CVE-2026-119500

    WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.

    bPlugins Flash & HTML5 Video
  • Medium 6.5
    CVE-2026-119365

    WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player A…

    bPlugins Media Player Addons for Elementor – Media Player widget for WP
  • Medium 6.5
    CVE-2026-118097

    WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.

    bPlugins Flash & HTML5 Video
  • Medium 6.5
    CVE-2026-116849

    WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

    bPlugins StreamCast
  • Medium 6.5
    CVE-2026-48195

    WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

    bPlugins PDF Poster
  • Medium 6.5
    CVE-2026-52709

    WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.

    bPlugins Video Gallery Block
  • Medium 6.4
    CVE-2026-109370

    Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute

    The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and incl…

    bPlugins Document Embedder – let visitors read files without downloading Web / CMS
  • High 7.5
    CVE-2026-116613

    Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute

    The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-…

    bPlugins Animated Text Block – Add Typing and Looping Text Effects Web / CMS
  • Medium 6.5
    CVE-2026-115966

    WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your texts many typing effects…

    bPlugins Typing Text – Give your texts many typing effects
  • Medium 6.5
    CVE-2026-116400

    WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.

    bPlugins Button Block
  • Medium 6.5
    CVE-2026-116398

    WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.

    bPlugins Content Slider Block
  • Medium 6.5
    CVE-2026-116395

    WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.

    bPlugins LightBox Block
  • Medium 6.5
    CVE-2026-115955

    WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid …

    bPlugins Advanced Post Block - Post Grid for WordPress block editor Web / CMS
  • Medium 6.5
    CVE-2026-115956

    WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: f…

    bPlugins Panorama Viewer – 360 Degree Image + Video Viewer
  • Medium 6.5
    CVE-2026-115961

    WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2.

    bPlugins B Slider
  • Medium 6.5
    CVE-2026-115613

    WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Crea…

    bPlugins Image Gallery block – Create and display photo gallery/photo album.
  • High 7.1
    CVE-2026-62037

    WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

    bPlugins Document Embedder
  • High 7.1
    CVE-2026-62034

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

    bPlugins Before After Image Comparison – Image comparison for WP
  • High 7.2
    CVE-2026-62030

    WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

    bPlugins StreamCast
  • High 7.1
    CVE-2026-62027

    WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

    bPlugins Team Section Block
  • High 7.2
    CVE-2026-62044

    WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

    bPlugins Super Video Player
  • Medium 5.4
    CVE-2026-62028

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image…

    bPlugins Before After Image Comparison – Image comparison for WP
  • Medium 6.5
    CVE-2026-62039

    WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.

    bPlugins Html5 Audio Player
  • High 7.1
    CVE-2026-42634

    WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

    bPlugins Video Background Block – Use video as background in the section.
  • Medium 6.5
    CVE-2026-104400

    WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

    bPlugins B Blocks
  • High 7.1
    CVE-2026-102378

    WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

    bPlugins Parallax Section block
  • Medium 4.3
    CVE-2026-5626

    Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export

    The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subs…

    bPlugins Survey Form Block – collect answers and insights from your audience Web / CMS
  • Medium 5.3
    CVE-2026-27422

    WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

    bPlugins YT Player
  • High 7.5
    CVE-2026-57647

    WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability

    Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.

    bPlugins Panorama Viewer – 360 Degree Image + Video Viewer
  • Medium 5.8
    CVE-2026-57323

    WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

    bPlugins Flash & HTML5 Video
  • High 8.3
    CVE-2026-56063

    WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

    bPlugins MailChimp Block
  • Medium 6.4
    CVE-2026-11402

    Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute

    The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output…

    bPlugins Services Section Block – Showcase Service Details in Grid or Columns Web / CMS
  • High 8.8
    CVE-2026-39579

    WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability

    Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

    bPlugins B Blocks
  • Medium 4.3
    CVE-2026-53736

    Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action

    Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless…

    bPlugins Easy Twitter Feeds
  • Medium 4.3
    CVE-2026-24520

    WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24.

    bPlugins Tiktok Feed
  • Medium 5.3
    CVE-2026-27416

    WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.

    bPlugins PDF Poster
  • Medium 5.4
    CVE-2026-6446

    My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action

    The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of authorization checks (no …

    bPlugins My Social Feeds – Social Feeds Embedder Plugin for WordPress Web / CMS
  • Medium 6.1
    CVE-2024-13362

    Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject …

    bPlugins webfactory unitecms nicheaddons Web / CMS
  • Medium 4.3
    CVE-2026-40729

    WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.

    bPlugins 3D viewer – Embed 3D Models
  • Medium 6.5
    CVE-2026-32489

    WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

    bPlugins B Blocks