What’s Vulnerable › Products

Themekraft BuddyForms vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your Themekraft BuddyForms version is affected

Latest Themekraft BuddyForms vulnerabilities

• CVE-2026-81785 — WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability (CVSS 6.5)
• CVE-2025-62973 — WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-32151 — WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability (CVSS 8.8)
• CVE-2024-12038 — Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode (CVSS 5.4)
• CVE-2024-47377 — WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2024-8246 — Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8)
• CVE-2024-5149 — BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness (CVSS 5.3)
• CVE-2024-32830 — WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability (CVSS 7.5)
• CVE-2024-30198 — WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-1158 — Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization (CVSS 4.3)
• CVE-2023-26326 — (CVSS 9.8)
• CVE-2018-21003 — (CVSS 9.8)