Skip to content
OpenAdvisories

Vendor

bPlugins

115 known vulnerabilities.

Products

B Blocks 6 Flash & HTML5 Video 5 bSlider – Create Responsive Image, Post, Product, and Video Sliders 4 Button Block 4 Html5 Audio Player 3 HTML5 Video Player – Embed and Play Videos in Custom Player 3 PDF Poster 3 B Slider 3 Tiktok Feed 3 StreamCast 3 Button Block – Design Stylish, Interactive, and Multi-Functional Buttons 2 Icon List Block 2 Panorama Viewer – 360 Degree Image + Video Viewer 2 Video Gallery Block 2 HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2 Info Cards 2 bBlocks – Essential Gutenberg Blocks & Patterns Collection 2 Image Gallery block – Create and display photo gallery/photo album. 2 LightBox Block 2 Before After Image Comparison – Image comparison for WP 2 Icons Font Loader 2 Parallax Section block 2 Document Embedder – Embed PDFs, Word, Excel, and Other Files 2 Team Section Block 2 Print Page block 1 Team Section Block – Showcase Team Members with Layout Options 1 Advanced scrollbar 1 Document Embedder – let visitors read files without downloading 1 Countdown Timer 1 Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters 1 Carousel Block – Responsive Image and Content Carousel 1 Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) 1 Logo Carousel – Clients logo carousel for WP 1 Media Player Addons for Elementor – Media Player widget for WP 1 Sticky Content 1 Alert Box Block – Display Custom Alerts and Messages 1 Typing Text – Give your texts many typing effects 1 MailChimp Block 1 Alert Box Block – Display notice/alerts in the front end 1 Icon List Block – Add Icon-Based Lists with Custom Styles 1
All Critical High Medium Low Exploited only Public exploit

115 results · Feed

  • Medium 6.5
    CVE-2025-26945

    WordPress Info Cards plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This issue affects Info Cards: from n/a through <= 1.0.5.

    bPlugins Info Cards
  • Medium 6.5
    CVE-2025-26939

    WordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS.This issue affects Counters Block: from n/a through <= 1.1.2.

    bPlugins Counters Block
  • Medium 6.5
    CVE-2025-26937

    WordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.

    bPlugins Icon List Block
  • Medium 6.5
    CVE-2025-26881

    WordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.

    bPlugins Sticky Content
  • Medium 6.5
    CVE-2025-26883

    WordPress Animated Text Block plugin <= 1.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.

    bPlugins Animated Text Block
  • Medium 6.5
    CVE-2025-26754

    WordPress Timeline Block plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Stored XSS.This issue affects Timeline Block: from n/a through <= 1.1.1.

    bPlugins Timeline Block
  • Medium 6.5
    CVE-2025-22675

    WordPress Alert Box Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alert…

    bPlugins Alert Box Block – Display notice/alerts in the front end
  • Medium 4.3
    CVE-2024-13514

    B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode

    The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb-slider' shortcode due to insufficient restrictions on which posts can be included. This makes it po…

    bPlugins bSlider – Create Responsive Image, Post, Product, and Video Sliders Web / CMS
  • Medium 6.5
    CVE-2025-24595

    WordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1…

    bPlugins All Embed – Elementor Addons
  • Medium 4.3
    CVE-2025-22787

    WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.

    bPlugins Button Block
  • Medium 6.4
    CVE-2024-13156

    HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter

    The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parameter in all versions up to, and including, 2.5.35 due to insufficient input sanitization and output e…

    bPlugins HTML5 Video Player – Embed and Play Videos in Custom Player Web / CMS
  • Medium 6.5
    CVE-2025-22815

    WordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.

    bPlugins Button Block
  • Medium 4.3
    CVE-2024-12560

    Button Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication

    The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authe…

    bPlugins Button Block – Design Stylish, Interactive, and Multi-Functional Buttons Web / CMS
  • Medium 6.4
    CVE-2024-11882

    FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'faq' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and …

    bPlugins Awesome FAQ – Modern Accordion, Tabs,Responsive & Super Fast FAQ Builder. Web / CMS
  • Medium 6.4
    CVE-2024-11880

    B Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping o…

    bPlugins B Testimonial – Customer Testimonials in Custom Layouts Web / CMS
  • Medium 4.3
    CVE-2024-10666

    Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure

    The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level acce…

    bPlugins Feeds for Twitter – Embed Social Media Posts with Live Updates Web / CMS
  • Medium 4.3
    CVE-2024-10671

    Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure

    The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on which posts can be in…

    bPlugins Button Block – Design Stylish, Interactive, and Multi-Functional Buttons Web / CMS
  • Medium 4.3
    CVE-2024-10667

    Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure

    The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated a…

    bPlugins Content Slider Block – Slide Through Text or Media Content Web / CMS
  • Medium 4.3
    CVE-2024-10669

    Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure

    The Countdown Timer block – Display the event&#039;s date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on which posts can be inclu…

    bPlugins Countdown Timer Block – Animated Countdown for Events or Launches Web / CMS
  • Medium 4.3
    CVE-2024-43296

    WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.

    bPlugins Flash & HTML5 Video
  • Medium 6.3
    CVE-2022-4974

    Freemius SDK <= 2.4.2 - Missing Authorization Checks

    The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_d…

    bPlugins saadiqbal Premmerce nicheaddons Web / CMS
  • Medium 6.5
    CVE-2024-47631

    WordPress Logo Carousel – Clients logo carousel for WP plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients log…

    bPlugins Logo Carousel – Clients logo carousel for WP
  • Medium 4.3
    CVE-2024-7721

    HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it po…

    bPlugins HTML5 Video Player – Embed and Play Videos in Custom Player Web / CMS
  • Medium 5.3
    CVE-2024-7727

    HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler

    The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and incl…

    bPlugins HTML5 Video Player – Embed and Play Videos in Custom Player Web / CMS
  • Medium 4.3
    CVE-2024-43319

    WordPress HTML5 Video Player plugin <= 2.5.31 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.

    bPlugins Flash & HTML5 Video
  • Medium 5.9
    CVE-2024-43148

    WordPress StreamCast <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins StreamCast allows Stored XSS.This issue affects StreamCast: from n/a through 2.2.3.

    bPlugins StreamCast
  • Medium 6.5
    CVE-2024-37445

    WordPress HTML5 Audio Player plugin <= 2.2.23 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.2.23.

    bPlugins Html5 Audio Player
  • Medium 6.4
    CVE-2024-4398

    HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on us…

    bPlugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player Web / CMS
  • Medium 5.3
    CVE-2024-0908

    Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure

    The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and in…

    bPlugins Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters Web / CMS
  • Medium 6.5
    CVE-2024-30432

    WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12.

    bPlugins B Slider - Slider for your block editor
  • Medium 6.5
    CVE-2024-30438

    WordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue affects Print Page block: from n/a through 1.0.8.

    bPlugins Print Page block
  • High 7.2
    CVE-2024-24714

    WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.

    bPlugins Icons Font Loader
  • High 7.1
    CVE-2024-23508

    WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a thro…

    bPlugins PDF Poster – PDF Embedder Plugin for WordPress Web / CMS
  • High 8.5
    CVE-2023-46084

    WordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This issue affects Icons Font Loader: from n/a through 1.1.2.

    bPlugins Icons Font Loader
  • High 7.2
    CVE-2023-5860

    Icons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload

    The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-l…

    bPlugins Icons Font Loader – Load Web Fonts and Icon Libraries Web / CMS