📦 Buddyforms

The BuddyForms WordPress plugin before version 2.7.8 contains an unauthenticated insecure deserialization vulnerability. Attackers can exploit this without credentials to execute arbitrary PHP code on...

This path traversal vulnerability in the BuddyForms WordPress plugin allows attackers to read arbitrary files and perform server-side request forgery (SSRF) attacks. It affects all BuddyForms installa...

This CVE describes a missing authorization vulnerability in the BuddyForms WordPress plugin that allows attackers to access functionality not properly constrained by access controls. Users running Bud...

This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts via the 'buddyforms_nav' shortcode. The scripts are stored and execute whene...

The BuddyForms WordPress plugin has an email verification bypass vulnerability due to insufficiently random activation codes. Unauthenticated attackers can bypass email verification requirements, pote...