Skip to content
OpenAdvisories

Vendor

Themekraft

24 known vulnerabilities.

Products

BuddyForms 8 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) 7 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages 3 WooBuddy 2 Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions 1 TK Google Fonts GDPR Compliant 1 Post Form 1 All in One Invite Codes 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2025-32151

    WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themekraft BuddyForms buddyforms allows PHP Local File Inclusion.This issue affects BuddyForms: from n/a through 2.10.2.

    Themekraft BuddyForms
  • High 8.8
    CVE-2024-8246

    Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

    The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly …

    Themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) Web / CMS
  • High 8.6
    CVE-2024-32830 Public exploit

    WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a through 2.8.8.

    Themekraft BuddyForms
  • High 8.5
    CVE-2024-32603

    WordPress WooBuddy plugin <= 3.4.20 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.20.

    Themekraft WooBuddy
  • High 8.8
    CVE-2024-2025

    BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request

    The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request funct…

    Themekraft BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Web / CMS
  • High 7.5
    CVE-2024-1169

    Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload

    The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyforms_upload_handle_dropped_me…

    Themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) Web / CMS
  • High 8.2
    CVE-2024-1170

    Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion

    The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handle_deleted_media functio…

    Themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) Web / CMS