Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: themekraft Component: Buddyforms Clear all filters
TI-2025-39121 CVE-2025-62973 · GHSA-hg8r-q6jx-8pfj

WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability

Priority LOW 24

Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00231 Published 2025-10-27 No fix listed CWE-862
TI-2025-23249 CVE-2025-32151 · GHSA-wq7m-v6h4-h5vf

WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability

Priority MEDIUM 42

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themekraft BuddyForms buddyforms allows PHP Local File Inclusion.This issue affects BuddyForms: fro…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00988 Published 2025-04-04 No fix listed CWE-98
TI-2024-11169 CVE-2024-12038 · GHSA-rg7g-5842-62w5

Cross-site scripting in themekraft Post Form – Registration Form – Profile Form for User…

Priority LOW 28

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyforms_nav' s…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-02-22 No fix listed CWE-79
TI-2024-31695 CVE-2024-47377 · GHSA-g7fq-fw7r-8jrh

WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themekraft BuddyForms buddyforms allows Stored XSS.This issue affects BuddyForms: from n/a through <= 2.8.12.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00274 Published 2024-10-05 No fix listed CWE-79
TI-2024-07644 CVE-2024-8246 · GHSA-3f92-cwf9-rgvq

Improper privilege management in themekraft Post Form – Registration Form – Profile Form…

Priority MEDIUM 40

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00431 Published 2024-09-14 No fix listed CWE-269
TI-2024-21704 CVE-2024-32830 · GHSA-w32p-xp8f-5vqc

WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability

Priority LOW 38

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a th…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00583 Published 2024-05-17 No fix listed CWE-22
TI-2024-01073 CVE-2024-1158 · GHSA-77cp-583r-8x6c

Missing authorization in themekraft Post Form – Registration Form – Profile Form for User…

Priority LOW 21

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00503 Published 2024-03-13 No fix listed CWE-862