Skip to content
OpenAdvisories

Vendor

bPlugins

114 known vulnerabilities.

Products

B Blocks 5 Flash & HTML5 Video 5 bSlider – Create Responsive Image, Post, Product, and Video Sliders 4 Button Block 4 Html5 Audio Player 3 HTML5 Video Player – Embed and Play Videos in Custom Player 3 PDF Poster 3 B Slider 3 Tiktok Feed 3 StreamCast 3 Button Block – Design Stylish, Interactive, and Multi-Functional Buttons 2 Icon List Block 2 Panorama Viewer – 360 Degree Image + Video Viewer 2 Video Gallery Block 2 HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2 Info Cards 2 bBlocks – Essential Gutenberg Blocks & Patterns Collection 2 Image Gallery block – Create and display photo gallery/photo album. 2 LightBox Block 2 Before After Image Comparison – Image comparison for WP 2 Icons Font Loader 2 Parallax Section block 2 Document Embedder – Embed PDFs, Word, Excel, and Other Files 2 Team Section Block 2 Print Page block 1 Team Section Block – Showcase Team Members with Layout Options 1 Advanced scrollbar 1 Document Embedder – let visitors read files without downloading 1 Countdown Timer 1 Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters 1 Carousel Block – Responsive Image and Content Carousel 1 Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) 1 Logo Carousel – Clients logo carousel for WP 1 Media Player Addons for Elementor – Media Player widget for WP 1 Sticky Content 1 Alert Box Block – Display Custom Alerts and Messages 1 Typing Text – Give your texts many typing effects 1 MailChimp Block 1 Alert Box Block – Display notice/alerts in the front end 1 Icon List Block – Add Icon-Based Lists with Custom Styles 1
All Critical High Medium Low Exploited only Public exploit

25 results · Clear filters · Feed

  • High 7.5
    CVE-2026-116613

    Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute

    The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-…

    bPlugins Animated Text Block – Add Typing and Looping Text Effects Web / CMS
  • High 7.1
    CVE-2026-62037

    WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

    bPlugins Document Embedder
  • High 7.1
    CVE-2026-62034

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

    bPlugins Before After Image Comparison – Image comparison for WP
  • High 7.2
    CVE-2026-62030

    WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

    bPlugins StreamCast
  • High 7.1
    CVE-2026-62027

    WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

    bPlugins Team Section Block
  • High 7.2
    CVE-2026-62044

    WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

    bPlugins Super Video Player
  • High 7.1
    CVE-2026-42634

    WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

    bPlugins Video Background Block – Use video as background in the section.
  • High 7.1
    CVE-2026-102378

    WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

    bPlugins Parallax Section block
  • High 7.5
    CVE-2026-57647

    WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability

    Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.

    bPlugins Panorama Viewer – 360 Degree Image + Video Viewer
  • High 8.3
    CVE-2026-56063

    WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

    bPlugins MailChimp Block
  • High 8.8
    CVE-2026-39579

    WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability

    Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

    bPlugins B Blocks
  • High 7.2
    CVE-2026-1294

    All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint

    The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for un…

    bPlugins All In One Image Viewer Block – Gutenberg block to create image viewer with hyperlink Web / CMS
  • High 7.2
    CVE-2025-13999

    HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery

    The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2.4.0 up to, and including, 2.5.1 via the getIcyMetadata() function. This makes it possible for un…

    bPlugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player Web / CMS
  • High 7.1
    CVE-2025-60079

    WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability

    Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Parallax Section block: from n/a through <= 1.0.9.

    bPlugins Parallax Section block
  • High 7.1
    CVE-2025-54711

    WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info Cards: from n/a through <= 1.0.11.

    bPlugins Info Cards
  • High 8.8
    CVE-2025-49900

    WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollbar: from n/a through <= 1.1.8.

    bPlugins Advanced scrollbar
  • High 7.1
    CVE-2025-49394

    WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability

    Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Image Gallery block – Create and display ph…

    bPlugins Image Gallery block – Create and display photo gallery/photo album.
  • High 8.6
    CVE-2025-12384

    Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation

    The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is a…

    bPlugins Document Embedder – Embed PDFs, Word, Excel, and Other Files Web / CMS
  • High 8.8
    CVE-2025-62007

    WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through <= 1.0.3.

    bPlugins Voice Feedback
  • High 7.1
    CVE-2025-54710

    WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tiktok Feed: from n/a through <= 1.0.21.

    bPlugins Tiktok Feed
  • High 8.8
    CVE-2025-8418

    B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation

    The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. This is due to missing capability checks on the activated_plugin function. This makes it possible for…

    bPlugins bSlider – Create Responsive Image, Post, Product, and Video Sliders Web / CMS
  • High 7.2
    CVE-2024-24714

    WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.

    bPlugins Icons Font Loader
  • High 7.1
    CVE-2024-23508

    WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a thro…

    bPlugins PDF Poster – PDF Embedder Plugin for WordPress Web / CMS
  • High 8.5
    CVE-2023-46084

    WordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This issue affects Icons Font Loader: from n/a through 1.1.2.

    bPlugins Icons Font Loader
  • High 7.2
    CVE-2023-5860

    Icons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload

    The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-l…

    bPlugins Icons Font Loader – Load Web Fonts and Icon Libraries Web / CMS