Extension WordPress
Vulnérabilités Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Cette page rassemble les failles publiées pour Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC), leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
20 fiches
BuddyForms <= 2.9.0 – Missing Authorization
The BuddyForms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.9.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.
*-2.9.0
Non indiqué
19/10/2025
BuddyForms <= 2.8.17 – Authenticated (Contributor+) Local File Inclusion
The BuddyForms plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.8.17. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the…
*-2.8.17
Non indiqué
04/04/2025
Frontend Content Forms for User Submissions (UGC) <= 2.8.15 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyforms_nav' shortcode in all versions up…
*-2.8.15
2.8.16
21/02/2025
Frontend Content Forms for User Submissions (UGC) <= 2.8.13 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bf_new_submission_link' shortcode in all versions up…
*-2.8.13
2.8.14
30/01/2025
BuddyForms <= 2.8.12 – Authenticated (Editor+) Stored Cross-Site Scripting
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including,…
*-2.8.12
2.8.13
30/09/2024
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 – Authenticated (Contributor+) Privilege Escalation
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is…
*-2.8.11
2.8.12
13/09/2024
BuddyForms <= 2.8.9 – Email Verification Bypass due to Insufficient Randomness
The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the…
*-2.8.9
2.8.10
04/06/2024
BuddyForms <= 2.8.8 – Unauthenticated Arbitrary File Read and Server-Side Request Forgery
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Arbitrary File Read and Server-Side Request Forgery in all versions up to,…
*-2.8.8
2.8.9
22/04/2024
BuddyForms <= 2.8.5 – Reflected Cross-Site Scripting via page
The BuddyForms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
*-2.8.5
2.8.6
25/03/2024
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 – Missing Authorization
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the…
*-2.8.7
2.8.8
06/03/2024
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 – Missing Authorization to Unauthenticated Media Upload
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyforms_upload_handle_dropped_media…
*-2.8.7
2.8.8
06/03/2024
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 – Missing Authorization to Unauthenticated Media Deletion
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the…
*-2.8.7
2.8.8
06/03/2024
Freemius SDK <= 2.5.9 – Reflected Cross-Site Scripting via fs_request_get
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
*-2.8.2
2.8.3
18/07/2023
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.8.1 due to insufficient…
*-2.8.1
2.8.2
11/05/2023
BuddyForms <= 2.7.7 – PHAR Deserialization
The BuddyForms plugin for WordPress is vulnerable to deserialization of untrusted input via the 'url' parameter in versions up to, and including 2.7.7. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to…
*-2.7.7
2.7.8
20/02/2023
BuddyForms <= 2.7.2 – Authenticated (Contributor+) Stored Stored Cross-Site Scripting
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above,…
*-2.7.2
2.7.3
27/10/2022
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.6.9 – Cross-Site Scripting
The Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.6.9 due to insufficient input…
*-2.6.9
2.6.10
26/06/2022
Freemius SDK <= 2.4.2 – Missing Authorization Checks
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions…
[*, 2.6.3)
2.6.3
04/03/2022
Freemius SDK <= 2.2.3 – Missing Authorization to Arbitrary Options Update
The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level…
[*, 2.3.2)
2.3.2
25/02/2019
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.2.7 – SQL Injection
The Buddyforms plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.2.7 due to insufficient escaping on a user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
*-2.2.7
2.2.8
09/11/2018
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.