themekraft

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

themekraft records in CISA KEV

No themekraft vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Buddyforms 11 records HIGH Buddypress Woocommerce My Account Integration 3 records MEDIUM Post Form 3 records MEDIUM Buddypress Woocommerce My Account Integration. Create Woocommerce Member Pages 1 record LOW Post Form Registration Form Profile Form For User Profiles And Content Forms 1 record LOW Tk Google Fonts Gdpr Compliant 1 record MEDIUM

Records

11 records in Buddyforms · all components

TI-2023-11479 CVE-2023-26326 · GHSA-c4hp-hwrc-92r3

Deserialization of untrusted data in BuddyForms WordPress Plugin

HIGH 82

The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03824 Published 2023-02-23 No fix listed CWE-502

TI-2018-14965 CVE-2018-21003 · GHSA-x3pc-ff2h-2j3r

The buddyforms plugin before 2.2.8 for WordPress has SQL injection.

MEDIUM 46

The buddyforms plugin before 2.2.8 for WordPress has SQL injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01833 Published 2019-08-27 No fix listed CWE-89

TI-2025-23249 CVE-2025-32151 · GHSA-wq7m-v6h4-h5vf

WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability

MEDIUM 42

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themekraft BuddyForms buddyforms allows PHP Local File Inclusion.This issue affects BuddyForms: fro…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00988 Published 2025-04-04 No fix listed CWE-98

TI-2024-07644 CVE-2024-8246 · GHSA-3f92-cwf9-rgvq

Improper privilege management in themekraft Post Form – Registration Form – Profile Form…

MEDIUM 40

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00431 Published 2024-09-14 No fix listed CWE-269

TI-2024-21704 CVE-2024-32830 · GHSA-w32p-xp8f-5vqc

WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability

LOW 38

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a th…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00583 Published 2024-05-17 No fix listed CWE-22

TI-2024-04780 CVE-2024-5149 · GHSA-xfjh-8mwq-67xv

BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness

LOW 35

The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00385 Published 2024-06-05 No fix listed CWE-330

TI-2024-11169 CVE-2024-12038 · GHSA-rg7g-5842-62w5

Cross-site scripting in themekraft Post Form – Registration Form – Profile Form for User…

LOW 28

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyforms_nav' s…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-02-22 No fix listed CWE-79

TI-2024-19944 CVE-2024-30198 · GHSA-9ww7-cjcf-gq83

WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeKraft BuddyForms allows Reflected XSS.This issue affects BuddyForms: from n/a through 2.8.5.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00312 Published 2024-03-27 No fix listed CWE-79

TI-2024-31695 CVE-2024-47377 · GHSA-g7fq-fw7r-8jrh

WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themekraft BuddyForms buddyforms allows Stored XSS.This issue affects BuddyForms: from n/a through <= 2.8.12.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00274 Published 2024-10-05 No fix listed CWE-79

TI-2025-39121 CVE-2025-62973 · GHSA-hg8r-q6jx-8pfj

WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability

LOW 24

Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00231 Published 2025-10-27 No fix listed CWE-862

TI-2024-01073 CVE-2024-1158 · GHSA-77cp-583r-8x6c

Missing authorization in themekraft Post Form – Registration Form – Profile Form for User…

LOW 21

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00503 Published 2024-03-13 No fix listed CWE-862

Open these records in search →