Bplugins
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
Unauthenticated cross-site scripting in the Team Section Block WordPress plugin (bPlugins), affecting all versions up to and including 2.0.4, lets a remote attacker supply script-bearing content that executes in a victim's browser when the affected block/page is rendered. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated bug whose practical severity is constrained by the mandatory victim interaction step - the payload only fires once a user (ideally a logged-in administrator) loads the injected content.
PHP object injection in the bPlugins Super Video Player WordPress plugin affects all versions through 1.8.13, allowing an authenticated high-privilege user to submit untrusted serialized data that the plugin passes to PHP's deserialization routines. Because the CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), the weakness is network-reachable and low-complexity but gated behind an administrator-level session in the affected WordPress installation, so anonymous and low-privilege visitors cannot reach the vulnerable path; no public exploit identified at time of analysis, and practical impact depends on the presence of a usable POP gadget chain in WordPress core, the plugin itself, or other installed components.
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.
Unauthenticated cross-site scripting in the bplugins 'Parallax Section' WordPress block plugin through version 2.0.4 allows remote attackers to inject script that executes in a victim's browser when the affected block renders attacker-controlled input. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load or interact with the page containing the injected payload - and the impact is confined to the victim's browser context rather than direct server compromise, so overall risk is moderate and heavily gated by user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available data does not specify a fixed plugin version.
Privilege escalation in the B Blocks WordPress plugin through version 2.0.31 allows authenticated users with Contributor-level access to elevate their privileges on the affected site. Reported by Patchstack and tracked as EUVD-2026-36965, the issue carries a CVSS 3.1 score of 8.8 reflecting full confidentiality, integrity, and availability impact once a low-privileged WordPress account is obtained. No public exploit identified at time of analysis, but the low attack complexity and lack of required user interaction make weaponization straightforward once an exploitation primitive is published.
Stored cross-site scripting (CWE-79) in the bPlugins 'Advanced Post Block - Post Grid for WordPress block editor' plugin, affecting every release through 2.5.1, allows a user holding a low-privileged authenticated account to persist script-bearing input that executes in another user's browser when that content is rendered. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) makes this a moderate, not urgent, priority: an attacker needs a valid account on the target site plus a victim who views the affected page, so exposure is concentrated on multi-author sites that grant contributor or author-level access to untrusted people. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available intelligence lists no fixed version beyond 2.5.1.
Stored cross-site scripting in the bPlugins 'Panorama Viewer - 360 Degree Image + Video Viewer' WordPress plugin, affecting all versions through 1.8.3, lets a low-privileged authenticated user plant a script payload that executes in the browser of a second user who later views the affected panorama content or admin screen. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), it is not unauthenticated and not self-triggering: the attacker needs a WordPress account able to create or edit panorama content, and a victim - administrator or site visitor - must render the page holding the stored payload. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's Patchstack advisory is the reference point for a fix.
Stored cross-site scripting in the bPlugins 'B Slider' WordPress plugin (versions through 2.2.2) allows an authenticated low-privileged user to persist script payloads that execute in the browser of anyone who later views the rendered slider, carrying a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The flaw is only reachable where the plugin is installed and accounts with content-contribution privileges (contributor/author level) can submit or edit slider content, and the payload fires only when a victim with an active browser session loads the affected page - typically an administrator or editor, which is where the scope-changed impact becomes meaningful. No CISA KEV entry or public exploit code was identified at time of analysis; the vuln.today priority label is 'this_month' and the entry was reported through Patchstack.
Stored cross-site scripting (CWE-79) in the bPlugins Image Gallery Block WordPress plugin (slug 3d-image-gallery) lets a low-privileged authenticated user - contributor/author level with content-creation rights - persist script payload through the plugin's block input, which executes in the browser of another user who later views the affected page. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), exposure is bounded by two prerequisites: the attacker must hold an account able to add or edit the gallery block, and a victim must interact with the crafted page, so exploitation is not self-propagating. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory linked from the CVE record is the primary reference; the issue is triaged for remediation within the current monthly cycle rather than emergency action.
Authenticated low-privilege users on WordPress sites running the bPlugins 'Before After Image Comparison - Image comparison for WP' plugin (all versions through 1.1.21) can reach plugin functionality that lacks proper authorization checks, allowing them to read and alter data the plugin is intended to restrict (CWE-862, CVSS 5.4). The defect is remotely reachable over the network with no user interaction (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so any site that allows self-registration or hosts multiple untrusted accounts provides the necessary foothold, while single-administrator sites with no untrusted users face minimal realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the low privilege prerequisite and network reachability make the prerequisite account easy to obtain on open-registration deployments.
Stored cross-site scripting in the bPlugins HTML5 Audio Player WordPress plugin (versions through 2.8.8) lets an authenticated low-privileged user - for example a contributor or author able to submit content the plugin stores - plant script payloads in plugin-handled data. The injected code persists and executes in the browser of any user who later views the affected page, such as an editor or administrator reviewing content, which can lead to session or credential theft and arbitrary actions in the victim's context; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and exploitation requires both an authenticated account on the target site and a victim who loads the tainted content, so sites that limit untrusted user registration are substantially less exposed.
Stored cross-site scripting in the bPlugins B Blocks WordPress plugin (all versions through 2.1.8) lets an authenticated user with posting privileges inject persistent JavaScript that executes in the browser of any privileged user who subsequently views the crafted block content. Rated CVSS 6.5 (medium), exploitation requires a low-privileged WordPress account and victim interaction, but it can lead to session theft, defacement, or administrative actions performed under the victim's identity. No public exploit code or active exploitation has been identified at time of analysis.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the bplugins Services Section Block WordPress plugin (all versions through 1.4.4) enables authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'link' block attribute. The payload evades wp_kses_post sanitization by embedding inside HTML comments at save time, then executes from two rendering paths - the primary service link anchor and a secondary title-wrapped anchor - when the linkIn option is set to 'title'. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the scope-changed (S:C) nature means injected content executes in any site visitor's browser session, enabling session hijacking or credential theft at scale.
Cross-site request forgery in the Easy Twitter Feeds WordPress plugin (versions before 1.2.13) allows unauthenticated remote attackers to trigger unauthorized post duplication by tricking an authenticated site user into visiting a crafted URL. The duplicate_post action handler fails to verify WordPress nonces, meaning any authenticated user's browser session can be silently weaponized to clone posts of any post type without their knowledge. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is version 1.2.13.
Broken access control in the bPlugins Tiktok Feed WordPress plugin (versions through 1.0.24) permits authenticated low-privileged users to perform actions that should be restricted to higher-privileged roles due to missing server-side authorization checks (CWE-862). Exploitation allows limited integrity impact - an attacker with a basic WordPress account could manipulate plugin-controlled data or settings without proper permission. No public exploit code exists and no active exploitation is confirmed at time of analysis; SSVC and EPSS signals both indicate low urgency.
Missing authorization controls in bPlugins PDF Poster WordPress plugin versions up to 2.4.1 allow unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control. The vulnerability exposes limited confidential data without requiring authentication or user interaction, affecting all default installations of the affected plugin versions.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization in the bPlugins 3D viewer WordPress plugin allows authenticated users with low privileges to bypass access controls and modify content. Affected versions up to and including 1.8.5. No public exploitation has been identified, EPSS score is very low (0.02%), and SSVC indicates no exploitation, so real-world risk is minimal.
Improper access control in bPlugins B Blocks versions prior to 2.0.30 allows unauthenticated remote attackers to modify data and degrade system availability through misconfigured security levels. The vulnerability requires no user interaction and can be exploited over the network, affecting the integrity and availability of affected installations.
The Info Cards - Add Text and Media in Card Layouts WordPress plugin versions up to 2.0.7 contains a Stored Cross-Site Scripting vulnerability in the 'btnUrl' parameter of the Info Cards block that allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript code. The vulnerability exists because the plugin fails to validate URL protocols (specifically javascript: schemes) on the server side, and the client-side rendering directly inserts unsanitized URLs into anchor href attributes, enabling script execution when users click the malicious button links. While there is no indication of active KEV exploitation, the low attack complexity and low privilege requirements make this a practical threat in multi-author WordPress environments.
bPlugins PDF Poster through version 2.4.0 contains an authorization bypass vulnerability that allows authenticated users to modify or disrupt PDF operations due to improperly configured access controls. An attacker with valid credentials could exploit this flaw to manipulate data integrity or cause service disruption without proper authorization checks.
Stored XSS in bPlugins Icon List Block through version 1.2.3 allows authenticated attackers to inject malicious scripts that execute in other users' browsers. An attacker with user-level access can craft malicious input that persists in the application and compromises the confidentiality, integrity, and availability of affected systems. No patch is currently available for this vulnerability.
Missing Authorization vulnerability in bPlugins LLC Button Block allows Accessing Functionality Not Properly Constrained by ACLs.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LLC Button Block allows Stored XSS.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block]. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.5.30. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HTML5 Video Player - mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The HTML5 Video Player - mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player allows Stored XSS.2.23. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.1.4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster - PDF Embedder Plugin for WordPress allows Reflected XSS.1.17. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.1.2. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The StreamCast - Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Polo Video Gallery - Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Html5 Audio Player - Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
Unauthenticated cross-site scripting in the Team Section Block WordPress plugin (bPlugins), affecting all versions up to and including 2.0.4, lets a remote attacker supply script-bearing content that executes in a victim's browser when the affected block/page is rendered. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated bug whose practical severity is constrained by the mandatory victim interaction step - the payload only fires once a user (ideally a logged-in administrator) loads the injected content.
PHP object injection in the bPlugins Super Video Player WordPress plugin affects all versions through 1.8.13, allowing an authenticated high-privilege user to submit untrusted serialized data that the plugin passes to PHP's deserialization routines. Because the CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), the weakness is network-reachable and low-complexity but gated behind an administrator-level session in the affected WordPress installation, so anonymous and low-privilege visitors cannot reach the vulnerable path; no public exploit identified at time of analysis, and practical impact depends on the presence of a usable POP gadget chain in WordPress core, the plugin itself, or other installed components.
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.
Unauthenticated cross-site scripting in the bplugins 'Parallax Section' WordPress block plugin through version 2.0.4 allows remote attackers to inject script that executes in a victim's browser when the affected block renders attacker-controlled input. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load or interact with the page containing the injected payload - and the impact is confined to the victim's browser context rather than direct server compromise, so overall risk is moderate and heavily gated by user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available data does not specify a fixed plugin version.
Privilege escalation in the B Blocks WordPress plugin through version 2.0.31 allows authenticated users with Contributor-level access to elevate their privileges on the affected site. Reported by Patchstack and tracked as EUVD-2026-36965, the issue carries a CVSS 3.1 score of 8.8 reflecting full confidentiality, integrity, and availability impact once a low-privileged WordPress account is obtained. No public exploit identified at time of analysis, but the low attack complexity and lack of required user interaction make weaponization straightforward once an exploitation primitive is published.
Stored cross-site scripting (CWE-79) in the bPlugins 'Advanced Post Block - Post Grid for WordPress block editor' plugin, affecting every release through 2.5.1, allows a user holding a low-privileged authenticated account to persist script-bearing input that executes in another user's browser when that content is rendered. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) makes this a moderate, not urgent, priority: an attacker needs a valid account on the target site plus a victim who views the affected page, so exposure is concentrated on multi-author sites that grant contributor or author-level access to untrusted people. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available intelligence lists no fixed version beyond 2.5.1.
Stored cross-site scripting in the bPlugins 'Panorama Viewer - 360 Degree Image + Video Viewer' WordPress plugin, affecting all versions through 1.8.3, lets a low-privileged authenticated user plant a script payload that executes in the browser of a second user who later views the affected panorama content or admin screen. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), it is not unauthenticated and not self-triggering: the attacker needs a WordPress account able to create or edit panorama content, and a victim - administrator or site visitor - must render the page holding the stored payload. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's Patchstack advisory is the reference point for a fix.
Stored cross-site scripting in the bPlugins 'B Slider' WordPress plugin (versions through 2.2.2) allows an authenticated low-privileged user to persist script payloads that execute in the browser of anyone who later views the rendered slider, carrying a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The flaw is only reachable where the plugin is installed and accounts with content-contribution privileges (contributor/author level) can submit or edit slider content, and the payload fires only when a victim with an active browser session loads the affected page - typically an administrator or editor, which is where the scope-changed impact becomes meaningful. No CISA KEV entry or public exploit code was identified at time of analysis; the vuln.today priority label is 'this_month' and the entry was reported through Patchstack.
Stored cross-site scripting (CWE-79) in the bPlugins Image Gallery Block WordPress plugin (slug 3d-image-gallery) lets a low-privileged authenticated user - contributor/author level with content-creation rights - persist script payload through the plugin's block input, which executes in the browser of another user who later views the affected page. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), exposure is bounded by two prerequisites: the attacker must hold an account able to add or edit the gallery block, and a victim must interact with the crafted page, so exploitation is not self-propagating. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory linked from the CVE record is the primary reference; the issue is triaged for remediation within the current monthly cycle rather than emergency action.
Authenticated low-privilege users on WordPress sites running the bPlugins 'Before After Image Comparison - Image comparison for WP' plugin (all versions through 1.1.21) can reach plugin functionality that lacks proper authorization checks, allowing them to read and alter data the plugin is intended to restrict (CWE-862, CVSS 5.4). The defect is remotely reachable over the network with no user interaction (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so any site that allows self-registration or hosts multiple untrusted accounts provides the necessary foothold, while single-administrator sites with no untrusted users face minimal realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the low privilege prerequisite and network reachability make the prerequisite account easy to obtain on open-registration deployments.
Stored cross-site scripting in the bPlugins HTML5 Audio Player WordPress plugin (versions through 2.8.8) lets an authenticated low-privileged user - for example a contributor or author able to submit content the plugin stores - plant script payloads in plugin-handled data. The injected code persists and executes in the browser of any user who later views the affected page, such as an editor or administrator reviewing content, which can lead to session or credential theft and arbitrary actions in the victim's context; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and exploitation requires both an authenticated account on the target site and a victim who loads the tainted content, so sites that limit untrusted user registration are substantially less exposed.
Stored cross-site scripting in the bPlugins B Blocks WordPress plugin (all versions through 2.1.8) lets an authenticated user with posting privileges inject persistent JavaScript that executes in the browser of any privileged user who subsequently views the crafted block content. Rated CVSS 6.5 (medium), exploitation requires a low-privileged WordPress account and victim interaction, but it can lead to session theft, defacement, or administrative actions performed under the victim's identity. No public exploit code or active exploitation has been identified at time of analysis.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the bplugins Services Section Block WordPress plugin (all versions through 1.4.4) enables authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'link' block attribute. The payload evades wp_kses_post sanitization by embedding inside HTML comments at save time, then executes from two rendering paths - the primary service link anchor and a secondary title-wrapped anchor - when the linkIn option is set to 'title'. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the scope-changed (S:C) nature means injected content executes in any site visitor's browser session, enabling session hijacking or credential theft at scale.
Cross-site request forgery in the Easy Twitter Feeds WordPress plugin (versions before 1.2.13) allows unauthenticated remote attackers to trigger unauthorized post duplication by tricking an authenticated site user into visiting a crafted URL. The duplicate_post action handler fails to verify WordPress nonces, meaning any authenticated user's browser session can be silently weaponized to clone posts of any post type without their knowledge. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is version 1.2.13.
Broken access control in the bPlugins Tiktok Feed WordPress plugin (versions through 1.0.24) permits authenticated low-privileged users to perform actions that should be restricted to higher-privileged roles due to missing server-side authorization checks (CWE-862). Exploitation allows limited integrity impact - an attacker with a basic WordPress account could manipulate plugin-controlled data or settings without proper permission. No public exploit code exists and no active exploitation is confirmed at time of analysis; SSVC and EPSS signals both indicate low urgency.
Missing authorization controls in bPlugins PDF Poster WordPress plugin versions up to 2.4.1 allow unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control. The vulnerability exposes limited confidential data without requiring authentication or user interaction, affecting all default installations of the affected plugin versions.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization in the bPlugins 3D viewer WordPress plugin allows authenticated users with low privileges to bypass access controls and modify content. Affected versions up to and including 1.8.5. No public exploitation has been identified, EPSS score is very low (0.02%), and SSVC indicates no exploitation, so real-world risk is minimal.
Improper access control in bPlugins B Blocks versions prior to 2.0.30 allows unauthenticated remote attackers to modify data and degrade system availability through misconfigured security levels. The vulnerability requires no user interaction and can be exploited over the network, affecting the integrity and availability of affected installations.
The Info Cards - Add Text and Media in Card Layouts WordPress plugin versions up to 2.0.7 contains a Stored Cross-Site Scripting vulnerability in the 'btnUrl' parameter of the Info Cards block that allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript code. The vulnerability exists because the plugin fails to validate URL protocols (specifically javascript: schemes) on the server side, and the client-side rendering directly inserts unsanitized URLs into anchor href attributes, enabling script execution when users click the malicious button links. While there is no indication of active KEV exploitation, the low attack complexity and low privilege requirements make this a practical threat in multi-author WordPress environments.
bPlugins PDF Poster through version 2.4.0 contains an authorization bypass vulnerability that allows authenticated users to modify or disrupt PDF operations due to improperly configured access controls. An attacker with valid credentials could exploit this flaw to manipulate data integrity or cause service disruption without proper authorization checks.
Stored XSS in bPlugins Icon List Block through version 1.2.3 allows authenticated attackers to inject malicious scripts that execute in other users' browsers. An attacker with user-level access can craft malicious input that persists in the application and compromises the confidentiality, integrity, and availability of affected systems. No patch is currently available for this vulnerability.
Missing Authorization vulnerability in bPlugins LLC Button Block allows Accessing Functionality Not Properly Constrained by ACLs.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LLC Button Block allows Stored XSS.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block]. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.5.30. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HTML5 Video Player - mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The HTML5 Video Player - mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player allows Stored XSS.2.23. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.1.4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster - PDF Embedder Plugin for WordPress allows Reflected XSS.1.17. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.1.2. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The StreamCast - Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Polo Video Gallery - Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Html5 Audio Player - Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.