Vendor CVEs

Bplugins

All CVEs

23 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-49900	Bplugins Advanced scrollbar	Hig	0.57	8.8	0.00	Nov 6, 2025	Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollbar: from n/a through <= 1.1.8.
CVE-2023-46084	Bplugins Icons Font Loader	Hig	0.55	8.5	0.01	Nov 6, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This issue affects Icons Font Loader: from n/a through 1.1.2.
CVE-2024-24714	Bplugins Icons Font Loader	Hig	0.47	7.2	0.01	Feb 26, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.
CVE-2025-60079	Bplugins Parallax Section block	Hig	0.46	7.1	0.00	Dec 18, 2025	Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Parallax Section block: from n/a through <= 1.0.9.
CVE-2024-23508	Bplugins PDF Poster	Hig	0.46	7.1	0.00	Jan 31, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.
CVE-2025-54051	Bplugins LightBox Block	Med	0.42	6.5	0.00	Jul 16, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.
CVE-2025-26949	Bplugins Team Section Block	Med	0.42	6.5	0.00	Feb 25, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.
CVE-2025-26947	Bplugins Services Section block	Med	0.42	6.5	0.00	Feb 25, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.
CVE-2025-26881	Bplugins Sticky Content	Med	0.42	6.5	0.00	Feb 25, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.
CVE-2025-22815	Bplugins Button Block	Med	0.42	6.5	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.
CVE-2024-47631	Bplugins Logo Carousel	Med	0.42	6.5	0.00	Oct 5, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for…
CVE-2023-5860	Bplugins Icons Font Loader	Hig	0.40	7.2	0.01	Nov 2, 2023	The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and…
CVE-2026-32416	Bplugins PDF Poster	Med	0.35	5.4	0.00	Mar 13, 2026	Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.
CVE-2026-27416	Bplugins PDF Poster	Med	0.34	5.3	0.00	May 7, 2026	Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.
CVE-2026-40729	Bplugins 3D viewer – Embed 3D Models	Med	0.28	4.3	0.00	Apr 15, 2026	Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.
CVE-2025-54694	Bplugins Button Block	Med	0.28	4.3	0.00	Aug 14, 2025	Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through <= 1.2.0.
CVE-2025-22787	Bplugins Button Block	Med	0.28	4.3	0.00	Jan 15, 2025	Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.
CVE-2024-43319	Bplugins Flash & HTML5 Video	Med	0.28	4.3	0.00	Aug 26, 2024	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
CVE-2024-12560	WordPress Button Block		0.00	—	0.00	Dec 19, 2024	The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated…
CVE-2024-10671	WordPress Button Block		0.00	—	0.01	Nov 21, 2024	The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on which posts can be included. This makes…
CVE-2024-43296	Bplugins Flash & HTML5 Video		0.00	—	0.00	Nov 1, 2024	Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.
CVE-2021-24739	Bplugins Logo Carousel		0.00	—	0.01	Dec 21, 2021	The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature
CVE-2021-24738	Bplugins Logo Carousel		0.00	—	0.01	Dec 21, 2021	The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVE-2025-49900HigNov 6, 2025
Bplugins
Advanced scrollbar
risk 0.57cvss 8.8epss 0.00
Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollbar: from n/a through <= 1.1.8.
CVE-2023-46084HigNov 6, 2023
Bplugins
Icons Font Loader
risk 0.55cvss 8.5epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This issue affects Icons Font Loader: from n/a through 1.1.2.
CVE-2024-24714HigFeb 26, 2024
Bplugins
Icons Font Loader
risk 0.47cvss 7.2epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.
CVE-2025-60079HigDec 18, 2025
Bplugins
Parallax Section block
risk 0.46cvss 7.1epss 0.00
Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Parallax Section block: from n/a through <= 1.0.9.
CVE-2024-23508HigJan 31, 2024
Bplugins
PDF Poster
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.
CVE-2025-54051MedJul 16, 2025
Bplugins
LightBox Block
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.
CVE-2025-26949MedFeb 25, 2025
Bplugins
Team Section Block
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.
CVE-2025-26947MedFeb 25, 2025
Bplugins
Services Section block
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.
CVE-2025-26881MedFeb 25, 2025
Bplugins
Sticky Content
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.
CVE-2025-22815MedJan 9, 2025
Bplugins
Button Block
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.
CVE-2024-47631MedOct 5, 2024
Bplugins
Logo Carousel
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for…
CVE-2023-5860HigNov 2, 2023
Bplugins
Icons Font Loader
risk 0.40cvss 7.2epss 0.01
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and…
CVE-2026-32416MedMar 13, 2026
Bplugins
PDF Poster
risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.
CVE-2026-27416MedMay 7, 2026
Bplugins
PDF Poster
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.
CVE-2026-40729MedApr 15, 2026
Bplugins
3D viewer – Embed 3D Models
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.
CVE-2025-54694MedAug 14, 2025
Bplugins
Button Block
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through <= 1.2.0.
CVE-2025-22787MedJan 15, 2025
Bplugins
Button Block
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.
CVE-2024-43319MedAug 26, 2024
Bplugins
Flash & HTML5 Video
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
CVE-2024-12560Dec 19, 2024
WordPress
Button Block
risk 0.00cvss —epss 0.00
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated…
CVE-2024-10671Nov 21, 2024
WordPress
Button Block
risk 0.00cvss —epss 0.01
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on which posts can be included. This makes…
CVE-2024-43296Nov 1, 2024
Bplugins
Flash & HTML5 Video
risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.
CVE-2021-24739Dec 21, 2021
Bplugins
Logo Carousel
risk 0.00cvss —epss 0.01
The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature
CVE-2021-24738Dec 21, 2021
Bplugins
Logo Carousel
risk 0.00cvss —epss 0.01
The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks