Skip to content
OpenAdvisories

Product · Themekraft

BuddyForms

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-107658

    BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

    The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes…

    Themekraft BuddyForms Web / CMS
  • Medium 6.5
    CVE-2026-81785

    WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.

    Themekraft BuddyForms
  • Medium 5.3
    CVE-2025-62973

    WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.

    Themekraft BuddyForms
  • Medium 5.9
    CVE-2024-47377

    WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themekraft BuddyForms buddyforms allows Stored XSS.This issue affects BuddyForms: from n/a through <= 2.8.12.

    Themekraft BuddyForms
  • Medium 5.8
    CVE-2024-30198

    WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeKraft BuddyForms allows Reflected XSS.This issue affects BuddyForms: from n/a through 2.8.5.

    Themekraft BuddyForms