Skip to content
OpenAdvisories

Vendor

bPlugins

114 known vulnerabilities.

Products

B Blocks 5 Flash & HTML5 Video 5 bSlider – Create Responsive Image, Post, Product, and Video Sliders 4 Button Block 4 Html5 Audio Player 3 HTML5 Video Player – Embed and Play Videos in Custom Player 3 PDF Poster 3 B Slider 3 Tiktok Feed 3 StreamCast 3 Button Block – Design Stylish, Interactive, and Multi-Functional Buttons 2 Icon List Block 2 Panorama Viewer – 360 Degree Image + Video Viewer 2 Video Gallery Block 2 HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2 Info Cards 2 bBlocks – Essential Gutenberg Blocks & Patterns Collection 2 Image Gallery block – Create and display photo gallery/photo album. 2 LightBox Block 2 Before After Image Comparison – Image comparison for WP 2 Icons Font Loader 2 Parallax Section block 2 Document Embedder – Embed PDFs, Word, Excel, and Other Files 2 Team Section Block 2 Print Page block 1 Team Section Block – Showcase Team Members with Layout Options 1 Advanced scrollbar 1 Document Embedder – let visitors read files without downloading 1 Countdown Timer 1 Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters 1 Carousel Block – Responsive Image and Content Carousel 1 Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) 1 Logo Carousel – Clients logo carousel for WP 1 Media Player Addons for Elementor – Media Player widget for WP 1 Sticky Content 1 Alert Box Block – Display Custom Alerts and Messages 1 Typing Text – Give your texts many typing effects 1 MailChimp Block 1 Alert Box Block – Display notice/alerts in the front end 1 Icon List Block – Add Icon-Based Lists with Custom Styles 1
All Critical High Medium Low Exploited only Public exploit

88 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-119500

    WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.

    bPlugins Flash & HTML5 Video
  • Medium 6.5
    CVE-2026-119365

    WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player A…

    bPlugins Media Player Addons for Elementor – Media Player widget for WP
  • Medium 6.5
    CVE-2026-118097

    WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.

    bPlugins Flash & HTML5 Video
  • Medium 6.5
    CVE-2026-116849

    WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

    bPlugins StreamCast
  • Medium 6.5
    CVE-2026-48195

    WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

    bPlugins PDF Poster
  • Medium 6.5
    CVE-2026-52709

    WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.

    bPlugins Video Gallery Block
  • Medium 6.4
    CVE-2026-109370

    Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute

    The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and incl…

    bPlugins Document Embedder – let visitors read files without downloading Web / CMS
  • Medium 6.5
    CVE-2026-115966

    WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your texts many typing effects…

    bPlugins Typing Text – Give your texts many typing effects
  • Medium 6.5
    CVE-2026-116400

    WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.

    bPlugins Button Block
  • Medium 6.5
    CVE-2026-116398

    WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.

    bPlugins Content Slider Block
  • Medium 6.5
    CVE-2026-116395

    WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.

    bPlugins LightBox Block
  • Medium 6.5
    CVE-2026-115955

    WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid …

    bPlugins Advanced Post Block - Post Grid for WordPress block editor Web / CMS
  • Medium 6.5
    CVE-2026-115956

    WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: f…

    bPlugins Panorama Viewer – 360 Degree Image + Video Viewer
  • Medium 6.5
    CVE-2026-115961

    WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2.

    bPlugins B Slider
  • Medium 6.5
    CVE-2026-115613

    WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Crea…

    bPlugins Image Gallery block – Create and display photo gallery/photo album.
  • Medium 5.4
    CVE-2026-62028

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image…

    bPlugins Before After Image Comparison – Image comparison for WP
  • Medium 6.5
    CVE-2026-62039

    WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.

    bPlugins Html5 Audio Player
  • Medium 6.5
    CVE-2026-104400

    WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

    bPlugins B Blocks
  • Medium 4.3
    CVE-2026-5626

    Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export

    The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subs…

    bPlugins Survey Form Block – collect answers and insights from your audience Web / CMS
  • Medium 5.3
    CVE-2026-27422

    WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

    bPlugins YT Player
  • Medium 5.8
    CVE-2026-57323

    WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

    bPlugins Flash & HTML5 Video
  • Medium 6.4
    CVE-2026-11402

    Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute

    The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output…

    bPlugins Services Section Block – Showcase Service Details in Grid or Columns Web / CMS
  • Medium 4.3
    CVE-2026-53736

    Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action

    Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless…

    bPlugins Easy Twitter Feeds
  • Medium 4.3
    CVE-2026-24520

    WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24.

    bPlugins Tiktok Feed
  • Medium 5.3
    CVE-2026-27416

    WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.

    bPlugins PDF Poster
  • Medium 5.4
    CVE-2026-6446

    My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action

    The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of authorization checks (no …

    bPlugins My Social Feeds – Social Feeds Embedder Plugin for WordPress Web / CMS
  • Medium 6.1
    CVE-2024-13362

    Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject …

    bPlugins webfactory unitecms nicheaddons Web / CMS
  • Medium 4.3
    CVE-2026-40729

    WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.

    bPlugins 3D viewer – Embed 3D Models
  • Medium 6.5
    CVE-2026-32489

    WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

    bPlugins B Blocks
  • Medium 6.4
    CVE-2026-4120

    Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes

    The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validat…

    bPlugins Info Cards – Add Text and Media in Card Layouts Web / CMS
  • Medium 5.4
    CVE-2026-32416

    WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.

    bPlugins PDF Poster
  • Medium 6.5
    CVE-2026-32359

    WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.2.3.

    bPlugins Icon List Block
  • Medium 4.3
    CVE-2026-1228

    Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute

    The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgb_shortcode() function due to missing…

    bPlugins Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) Web / CMS
  • Medium 4.3
    CVE-2026-1389

    Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion

    The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access t…

    bPlugins Document Embedder – Embed PDFs, Word, Excel, and Other Files Web / CMS
  • Medium 6.5
    CVE-2026-24565

    WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects B Accordion: from n/a through <= 2.0.2.

    bPlugins B Accordion
  • Medium 6.5
    CVE-2026-24383

    WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issue affects B Slider: from n/a through <= 2.0.6.

    bPlugins B Slider
  • Medium 6.4
    CVE-2026-0833

    Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link

    The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user-supplied social network link URLs. T…

    bPlugins Team Section Block – Showcase Team Members with Layout Options Web / CMS
  • Medium 5.3
    CVE-2025-66110

    WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through <= 1.0.23.

    bPlugins Tiktok Feed
  • Medium 6.4
    CVE-2025-12376

    Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery

    The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.1 via the fs_api_request function. This makes it possible for authenticated attackers, wi…

    bPlugins Icon List Block – Add Icon-Based Lists with Custom Styles Web / CMS
  • Medium 6.4
    CVE-2025-12388

    B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery

    The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1.5. This is due to the plugin not validating user-supplied URLs before passing them to the wp_r…

    bPlugins Carousel Block – Responsive Image and Content Carousel Web / CMS