Recently modified vulnerabilities for vendor "bplugins"

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

First published (updated )

CVE-2026-104400

bPlugins B SliderWordPress B Slider Plugin <= 1.1.30 - Broken Access Control Vulnerability

Risk 30

Severity

5.8

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Slider: from n/a through <= 1.1.30.

First published (updated )

CVE-2025-54734

bPlugins Tiktok FeedWordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability

Risk 48

Severity

7.1

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tiktok Feed: from n/a through <= 1.0.21.

Remedy

Update the WordPress Tiktok Feed plugin to the latest available version (at least 1.0.22).

First published (updated )

CVE-2025-54710

bPlugins YT PlayerWordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability

Risk 27

Severity

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

First published (updated )

CVE-2026-27422

bPlugins Tiktok FeedWordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Tiktok Feed: from n/a through 1.0.24.

First published (updated )

CVE-2026-24520

bPlugins Team Section BlockWordPress Team Section Block plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

Risk 26

Severity

6.5

EPSS

0.03%

XSS

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.

Remedy

Update the WordPress Team Section Block wordpress plugin to the latest available version (at least 1.1.0).

First published (updated )

CVE-2025-26949

bPlugins Services Section blockWordPress Services Section block plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Risk 26

Severity

6.5

EPSS

0.03%

XSS

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.

Remedy

Update the WordPress Services Section block wordpress plugin to the latest available version (at least 1.3.5).

First published (updated )

CVE-2025-26947

bPlugins Countdown TimerWordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Risk 26

Severity

6.5

EPSS

0.03%

XSS

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS.This issue affects Countdown Timer: from n/a through <= 1.2.6.

Remedy

Update the WordPress Countdown Timer wordpress plugin to the latest available version (at least 1.2.7).

First published (updated )

CVE-2025-26938

bPlugins Animated Text BlockWordPress Animated Text Block plugin <= 1.0.7 - Broken Access Control vulnerability

Risk 26

Severity

6.5

EPSS

0.03%

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.

First published (updated )

CVE-2025-26883

bPlugins Sticky ContentWordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Risk 26

Severity

6.5

EPSS

0.03%

XSS

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.

Remedy

Update the WordPress Sticky Content wordpress plugin to the latest available version (at least 1.0.2).

First published (updated )

CVE-2025-26881

bPlugins Timeline BlockWordPress Timeline Block plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Risk 26

Severity

6.5

EPSS

0.04%

XSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Stored XSS.This issue affects Timeline Block: from n/a through <= 1.1.1.

Remedy

Update the WordPress Timeline Block wordpress plugin to the latest available version (at least 1.1.3).

First published (updated )

CVE-2025-26754

bPlugins Html5 Video Player WordpressHTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Risk 28

Severity

6.5

EPSS

0.05%

SQL Injection

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

First published (updated )

CVE-2024-5522

bPlugins Icons Font Loader WordpressWordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload

Risk 49

Severity

7.2

EPSS

0.04%

Malicious File Upload

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.

First published (updated )

CVE-2024-24714

bPlugins Pdf Poster WordpressWordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)

Risk 36

Severity

7.1

EPSS

0.05%

XSS

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.

First published (updated )

CVE-2024-23508

bPlugins Html5 Video Player WordpressSQL Injection

Risk 61

Severity

9.8

EPSS

0.93%

SQL Injection

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'getview' function.

First published (updated )

CVE-2024-1061

bPlugins B BlocksWordPress B Blocks Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability

Risk 46

Severity

6.5

XSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks allows DOM-Based XSS. This issue affects B Blocks: from n/a through 2.0.5.

1 / 2

Source: NVD

Remedy

Update the WordPress B Blocks plugin to the latest available version (at least 2.0.6).

First published (updated )

CVE-2025-54708

bPlugins Button Block WordpressWordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

Risk 25

Severity

6.5

EPSS

0.04%

XSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.

First published (updated )

CVE-2025-22815

bPlugins PDF PosterWordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects PDF Poster: from n/a through 2.4.1.

Remedy

Update the WordPress PDF Poster Plugin to the latest available version (at least 2.5.0).

First published (updated )

CVE-2026-27416

bPlugins Icons Font Loader WordpressWordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to SQL Injection

Risk 79

Severity

8.8

SQL Injection

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This issue affects Icons Font Loader: from n/a through 1.1.2.

Remedy

Update to 1.1.2.1 or a higher version.

First published (updated )

CVE-2023-46084

bPlugins B BlocksWordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability

Risk 40

Severity

6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

First published (updated )

CVE-2026-32489

bPlugins Advanced scrollbarWordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability

Risk 79

Severity

8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollbar: from n/a through <= 1.1.8.

First published (updated )

CVE-2025-49900

bPlugins Print Page blockWordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Risk 34

Severity

6.5

EPSS

0.04%

XSS

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue affects Print Page block: from n/a through 1.0.8.

Remedy

Update to 1.0.9 or a higher version.

First published (updated )

CVE-2024-30438

bPlugins B Slider (WordPress plugin)WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerability

Risk 34

Severity

6.5

EPSS

0.04%

XSS

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12.

Remedy

Update to 1.1.13 or a higher version.

First published (updated )

CVE-2024-30432

bPlugins Voice FeedbackWordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability

Risk 79

Severity

8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through <= 1.0.3.

First published (updated )

CVE-2025-62007

bPlugins B Accordion (b-accordion)WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability

Risk 27

Severity

6.5

EPSS

0.03%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects B Accordion: from n/a through <= 2.0.2.

First published (updated )

CVE-2026-24565

bPlugins Tiktok FeedWordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through <= 1.0.23.

First published (updated )

CVE-2025-66110

bPlugins Info CardsWordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability

Risk 48

Severity

7.1

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info Cards: from n/a through <= 1.0.11.

First published (updated )

CVE-2025-54711

bPlugins Image GalleryWordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability

Risk 48

Severity

7.1

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through <= 1.0.7.

First published (updated )

CVE-2025-49394

bPlugins Html5 Audio PlayerWordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability

Risk 34

Severity

6.5

EPSS

0.03%

XSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player allows Stored XSS. This issue affects Html5 Audio Player: from n/a through 2.2.28.

1 / 2

Source: NVD

First published (updated )

CVE-2025-39524

bPlugins B BlocksWordPress B Blocks plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Risk 26

Severity

6.5

EPSS

0.03%

XSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through <= 2.0.0.

First published (updated )

CVE-2025-32173

Trending

Vendor Risk Score

Software

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Company

Resources

Contact