Skip to content
OpenAdvisories

Vendor

bPlugins

115 known vulnerabilities.

Products

B Blocks 6 Flash & HTML5 Video 5 bSlider – Create Responsive Image, Post, Product, and Video Sliders 4 Button Block 4 Html5 Audio Player 3 HTML5 Video Player – Embed and Play Videos in Custom Player 3 PDF Poster 3 B Slider 3 Tiktok Feed 3 StreamCast 3 Button Block – Design Stylish, Interactive, and Multi-Functional Buttons 2 Icon List Block 2 Panorama Viewer – 360 Degree Image + Video Viewer 2 Video Gallery Block 2 HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2 Info Cards 2 bBlocks – Essential Gutenberg Blocks & Patterns Collection 2 Image Gallery block – Create and display photo gallery/photo album. 2 LightBox Block 2 Before After Image Comparison – Image comparison for WP 2 Icons Font Loader 2 Parallax Section block 2 Document Embedder – Embed PDFs, Word, Excel, and Other Files 2 Team Section Block 2 Print Page block 1 Team Section Block – Showcase Team Members with Layout Options 1 Advanced scrollbar 1 Document Embedder – let visitors read files without downloading 1 Countdown Timer 1 Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters 1 Carousel Block – Responsive Image and Content Carousel 1 Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) 1 Logo Carousel – Clients logo carousel for WP 1 Media Player Addons for Elementor – Media Player widget for WP 1 Sticky Content 1 Alert Box Block – Display Custom Alerts and Messages 1 Typing Text – Give your texts many typing effects 1 MailChimp Block 1 Alert Box Block – Display notice/alerts in the front end 1 Icon List Block – Add Icon-Based Lists with Custom Styles 1
All Critical High Medium Low Exploited only Public exploit

89 results · Clear filters · Feed

  • Medium 6.4
    CVE-2025-12388

    B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery

    The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1.5. This is due to the plugin not validating user-supplied URLs before passing them to the wp_r…

    bPlugins Carousel Block – Responsive Image and Content Carousel Web / CMS
  • Medium 4.0
    CVE-2025-10735

    Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery

    The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers …

    bPlugins Block for Mailchimp – Add Email Subscription Forms and Collect Leads Web / CMS
  • Medium 6.4
    CVE-2025-9203

    Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields

    The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_artist_name' parameters in version 1.0.5. This is due to insufficient input sanitization and output esc…

    bPlugins Media Player Addons for Elementor – Audio and Video Widgets for Elementor Web / CMS
  • Medium 5.8
    CVE-2025-54734

    WordPress B Slider Plugin <= 1.1.30 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Slider: from n/a through <= 1.1.30.

    bPlugins B Slider
  • Medium 4.3
    CVE-2025-8680

    B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery

    The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level a…

    bPlugins bSlider – Create Responsive Image, Post, Product, and Video Sliders Web / CMS
  • Medium 4.3
    CVE-2025-8676

    B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure

    The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via the get_active_plugins function. This makes it possible for authenticated attackers, with subscriber…

    bPlugins bSlider – Create Responsive Image, Post, Product, and Video Sliders Web / CMS
  • Medium 6.5
    CVE-2025-54708

    WordPress B Blocks Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issue affects B Blocks: from n/a through <= 2.0.5.

    bPlugins B Blocks
  • Medium 4.3
    CVE-2025-54694

    WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through <= 1.2.0.

    bPlugins Button Block
  • Medium 6.5
    CVE-2025-54051

    WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.

    bPlugins LightBox Block
  • Medium 6.5
    CVE-2025-27326

    WordPress Video Gallery Block plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through <= 1.1.0.

    bPlugins Video Gallery Block
  • Medium 6.4
    CVE-2025-2579

    Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

    The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi…

    bPlugins Lottie Player – Add Interactive Lottie Animations with Block Support Web / CMS
  • Medium 6.5
    CVE-2025-39524

    WordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through <= 2.2.28.

    bPlugins Html5 Audio Player
  • Medium 6.5
    CVE-2025-32173

    WordPress B Blocks plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through <= 2.0.0.

    bPlugins B Blocks
  • Medium 6.4
    CVE-2024-13731

    Alert Box Block – Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Block

    The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box block in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output esca…

    bPlugins Alert Box Block – Display Custom Alerts and Messages Web / CMS
  • Medium 6.5
    CVE-2025-26949

    WordPress Team Section Block plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.

    bPlugins Team Section Block
  • Medium 6.5
    CVE-2025-26952

    WordPress Business Card Block plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block business-card-block allows Stored XSS.This issue affects Business Card Block: from n/a through <= 1.0.5.

    bPlugins Business Card Block
  • Medium 6.5
    CVE-2025-26947

    WordPress Services Section block plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.

    bPlugins Services Section block
  • Medium 6.5
    CVE-2025-26938

    WordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS.This issue affects Countdown Timer: from n/a through <= 1.2.6.

    bPlugins Countdown Timer
  • Medium 6.5
    CVE-2025-26945

    WordPress Info Cards plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This issue affects Info Cards: from n/a through <= 1.0.5.

    bPlugins Info Cards
  • Medium 6.5
    CVE-2025-26939

    WordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS.This issue affects Counters Block: from n/a through <= 1.1.2.

    bPlugins Counters Block
  • Medium 6.5
    CVE-2025-26937

    WordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.

    bPlugins Icon List Block
  • Medium 6.5
    CVE-2025-26881

    WordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.

    bPlugins Sticky Content
  • Medium 6.5
    CVE-2025-26883

    WordPress Animated Text Block plugin <= 1.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.

    bPlugins Animated Text Block
  • Medium 6.5
    CVE-2025-26754

    WordPress Timeline Block plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Stored XSS.This issue affects Timeline Block: from n/a through <= 1.1.1.

    bPlugins Timeline Block
  • Medium 6.5
    CVE-2025-22675

    WordPress Alert Box Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alert…

    bPlugins Alert Box Block – Display notice/alerts in the front end
  • Medium 4.3
    CVE-2024-13514

    B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode

    The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb-slider' shortcode due to insufficient restrictions on which posts can be included. This makes it po…

    bPlugins bSlider – Create Responsive Image, Post, Product, and Video Sliders Web / CMS
  • Medium 6.5
    CVE-2025-24595

    WordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1…

    bPlugins All Embed – Elementor Addons
  • Medium 4.3
    CVE-2025-22787

    WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.

    bPlugins Button Block
  • Medium 6.4
    CVE-2024-13156

    HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter

    The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parameter in all versions up to, and including, 2.5.35 due to insufficient input sanitization and output e…

    bPlugins HTML5 Video Player – Embed and Play Videos in Custom Player Web / CMS
  • Medium 6.5
    CVE-2025-22815

    WordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.

    bPlugins Button Block
  • Medium 4.3
    CVE-2024-12560

    Button Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication

    The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authe…

    bPlugins Button Block – Design Stylish, Interactive, and Multi-Functional Buttons Web / CMS
  • Medium 6.4
    CVE-2024-11882

    FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'faq' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and …

    bPlugins Awesome FAQ – Modern Accordion, Tabs,Responsive & Super Fast FAQ Builder. Web / CMS
  • Medium 6.4
    CVE-2024-11880

    B Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping o…

    bPlugins B Testimonial – Customer Testimonials in Custom Layouts Web / CMS
  • Medium 4.3
    CVE-2024-10666

    Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure

    The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level acce…

    bPlugins Feeds for Twitter – Embed Social Media Posts with Live Updates Web / CMS
  • Medium 4.3
    CVE-2024-10671

    Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure

    The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on which posts can be in…

    bPlugins Button Block – Design Stylish, Interactive, and Multi-Functional Buttons Web / CMS
  • Medium 4.3
    CVE-2024-10667

    Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure

    The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated a…

    bPlugins Content Slider Block – Slide Through Text or Media Content Web / CMS
  • Medium 4.3
    CVE-2024-10669

    Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure

    The Countdown Timer block – Display the event&#039;s date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on which posts can be inclu…

    bPlugins Countdown Timer Block – Animated Countdown for Events or Launches Web / CMS
  • Medium 4.3
    CVE-2024-43296

    WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.

    bPlugins Flash & HTML5 Video
  • Medium 6.3
    CVE-2022-4974

    Freemius SDK <= 2.4.2 - Missing Authorization Checks

    The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_d…

    bPlugins saadiqbal Premmerce nicheaddons Web / CMS
  • Medium 6.5
    CVE-2024-47631

    WordPress Logo Carousel – Clients logo carousel for WP plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients log…

    bPlugins Logo Carousel – Clients logo carousel for WP