# cve.now: Bplugins

The newest entries naming Bplugins as an affected vendor (up to 200), of 114 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119500](https://cve.now/CVE-2026-119500.md): WordPress Flash & HTML5 Video plugin \<= 2.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-119365](https://cve.now/CVE-2026-119365.md): WordPress Media Player Addons for Elementor – Media Player widget for WP plugin \<= 1.1.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-118097](https://cve.now/CVE-2026-118097.md): WordPress Flash & HTML5 Video plugin \<= 2.14.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-116849](https://cve.now/CVE-2026-116849.md): WordPress StreamCast plugin \<= 2.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-48195](https://cve.now/CVE-2026-48195.md): WordPress PDF Poster plugin \<= 2.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-52709](https://cve.now/CVE-2026-52709.md): WordPress Video Gallery Block plugin \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-109370](https://cve.now/CVE-2026-109370.md): Document Embedder \<= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute (CVSS 6.4)
- [CVE-2026-116613](https://cve.now/CVE-2026-116613.md): Animated Text Block \<= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute (CVSS 7.5)
- [CVE-2026-115966](https://cve.now/CVE-2026-115966.md): WordPress Typing Text – Give your texts many typing effects plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-116400](https://cve.now/CVE-2026-116400.md): WordPress Button Block plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-116398](https://cve.now/CVE-2026-116398.md): WordPress Content Slider Block plugin \<= 3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-116395](https://cve.now/CVE-2026-116395.md): WordPress LightBox Block plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-115955](https://cve.now/CVE-2026-115955.md): WordPress Advanced Post Block - Post Grid for WordPress block editor plugin \<= 2.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-115956](https://cve.now/CVE-2026-115956.md): WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin \<= 1.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-115961](https://cve.now/CVE-2026-115961.md): WordPress B Slider plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-115613](https://cve.now/CVE-2026-115613.md): WordPress Image Gallery block – Create and display photo gallery/photo album. plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-62037](https://cve.now/CVE-2026-62037.md): WordPress Document Embedder plugin \<= 2.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-62034](https://cve.now/CVE-2026-62034.md): WordPress Before After Image Comparison – Image comparison for WP plugin \<= 1.1.21 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-62030](https://cve.now/CVE-2026-62030.md): WordPress StreamCast plugin \<= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2)
- [CVE-2026-62027](https://cve.now/CVE-2026-62027.md): WordPress Team Section Block plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-62044](https://cve.now/CVE-2026-62044.md): WordPress Super Video Player plugin \<= 1.8.13 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-62028](https://cve.now/CVE-2026-62028.md): WordPress Before After Image Comparison – Image comparison for WP plugin \<= 1.1.21 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-62039](https://cve.now/CVE-2026-62039.md): WordPress Html5 Audio Player plugin \<= 2.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-42634](https://cve.now/CVE-2026-42634.md): WordPress Video Background Block – Use video as background in the section. plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-104400](https://cve.now/CVE-2026-104400.md): WordPress B Blocks plugin \<= 2.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-102378](https://cve.now/CVE-2026-102378.md): WordPress Parallax Section block plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-5626](https://cve.now/CVE-2026-5626.md): Survey Form Block \<= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export (CVSS 4.3)
- [CVE-2026-27422](https://cve.now/CVE-2026-27422.md): WordPress YT Player plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-57647](https://cve.now/CVE-2026-57647.md): WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin \<= 1.6.1 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-57323](https://cve.now/CVE-2026-57323.md): WordPress Flash & HTML5 Video plugin \<= 2.11.0 - Broken Access Control vulnerability (CVSS 5.8)
- [CVE-2026-56063](https://cve.now/CVE-2026-56063.md): WordPress MailChimp Block plugin \<= 1.1.15 - Broken Access Control vulnerability (CVSS 8.3)
- [CVE-2026-11402](https://cve.now/CVE-2026-11402.md): Services Section Block \<= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute (CVSS 6.4)
- [CVE-2026-39579](https://cve.now/CVE-2026-39579.md): WordPress B Blocks plugin \<= 2.0.31 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2026-53736](https://cve.now/CVE-2026-53736.md): Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate\_post Action (CVSS 5.1)
- [CVE-2026-24520](https://cve.now/CVE-2026-24520.md): WordPress Tiktok Feed plugin \<= 1.0.24 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-27416](https://cve.now/CVE-2026-27416.md): WordPress PDF Poster plugin \<= 2.4.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-6446](https://cve.now/CVE-2026-6446.md): My Social Feeds \<= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp\_get\_accounts' AJAX Action (CVSS 5.4)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2026-40729](https://cve.now/CVE-2026-40729.md): WordPress 3D viewer – Embed 3D Models plugin \<= 1.8.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-32489](https://cve.now/CVE-2026-32489.md): WordPress B Blocks plugin \< 2.0.30 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-4120](https://cve.now/CVE-2026-4120.md): Info Cards \<= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4)
- [CVE-2026-32416](https://cve.now/CVE-2026-32416.md): WordPress PDF Poster plugin \<= 2.4.0 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-32359](https://cve.now/CVE-2026-32359.md): WordPress Icon List Block plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-1228](https://cve.now/CVE-2026-1228.md): Timeline Block \<= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute (CVSS 4.3)
- [CVE-2026-1294](https://cve.now/CVE-2026-1294.md): All In One Image Viewer Block \<= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint (CVSS 7.2)
- [CVE-2026-1389](https://cve.now/CVE-2026-1389.md): Document Embedder \<= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion (CVSS 4.3)
- [CVE-2026-24565](https://cve.now/CVE-2026-24565.md): WordPress B Accordion plugin \<= 2.0.2 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-24383](https://cve.now/CVE-2026-24383.md): WordPress B Slider plugin \<= 2.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-0833](https://cve.now/CVE-2026-0833.md): Team Section Block \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link (CVSS 6.4)
- [CVE-2025-13999](https://cve.now/CVE-2025-13999.md): HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery (CVSS 7.2)
- [CVE-2025-60079](https://cve.now/CVE-2025-60079.md): WordPress Parallax Section block plugin \<= 1.0.9 - Broken Authentication vulnerability (CVSS 7.1)
- [CVE-2025-66110](https://cve.now/CVE-2025-66110.md): WordPress Tiktok Feed plugin \<= 1.0.23 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-12376](https://cve.now/CVE-2025-12376.md): Icon List Block – Add Icon-Based Lists with Custom Styles \<= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4)
- [CVE-2025-54711](https://cve.now/CVE-2025-54711.md): WordPress Info Cards Plugin \<= 1.0.11 - Broken Access Control Vulnerability (CVSS 7.1)
- [CVE-2025-49900](https://cve.now/CVE-2025-49900.md): WordPress Advanced scrollbar plugin \<= 1.1.8 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-49394](https://cve.now/CVE-2025-49394.md): WordPress Image Gallery block – Create and display photo gallery/photo album. plugin \<= 1.0.7 - Broken Authentication vulnerability (CVSS 7.1)
- [CVE-2025-12384](https://cve.now/CVE-2025-12384.md): Document Embedder – Embed PDFs, Word, Excel, and Other Files \<= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation (CVSS 8.6)
- [CVE-2025-12388](https://cve.now/CVE-2025-12388.md): B Carousel Block – Responsive Image and Content Carousel \<= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4)
- [CVE-2025-62007](https://cve.now/CVE-2025-62007.md): WordPress Voice Feedback plugin \<= 1.0.3 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-10735](https://cve.now/CVE-2025-10735.md): Block For Mailchimp – Easy Mailchimp Form Integration \<= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery (CVSS 4.0)
- [CVE-2025-9203](https://cve.now/CVE-2025-9203.md): Media Player Addons for Elementor \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields (CVSS 6.4)
- [CVE-2025-54734](https://cve.now/CVE-2025-54734.md): WordPress B Slider Plugin \<= 1.1.30 - Broken Access Control Vulnerability (CVSS 5.8)
- [CVE-2025-54710](https://cve.now/CVE-2025-54710.md): WordPress Tiktok Feed Plugin \<= 1.0.21 - Broken Access Control Vulnerability (CVSS 7.1)
- [CVE-2025-8676](https://cve.now/CVE-2025-8676.md): B Slider - Gutenberg Slider Block for WP \<= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-8680](https://cve.now/CVE-2025-8680.md): B Slider - Gutenberg Slider Block for WP \<= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 4.3)
- [CVE-2025-54708](https://cve.now/CVE-2025-54708.md): WordPress B Blocks Plugin \<= 2.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-54694](https://cve.now/CVE-2025-54694.md): WordPress Button Block Plugin plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-8418](https://cve.now/CVE-2025-8418.md): B Slider- Gutenberg Slider Block for WP \<= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation (CVSS 8.8)
- [CVE-2025-8059](https://cve.now/CVE-2025-8059.md): B Blocks \<= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr\_registration Function (CVSS 9.8)
- [CVE-2025-54051](https://cve.now/CVE-2025-54051.md): WordPress LightBox Block plugin \<= 1.1.30 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-27326](https://cve.now/CVE-2025-27326.md): WordPress Video Gallery Block plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-2579](https://cve.now/CVE-2025-2579.md): Lottie Player \<= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload (CVSS 6.4)
- [CVE-2025-39524](https://cve.now/CVE-2025-39524.md): WordPress Html5 Audio Player plugin \<= 2.2.28 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-32173](https://cve.now/CVE-2025-32173.md): WordPress B Blocks plugin \<= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-13731](https://cve.now/CVE-2024-13731.md): Alert Box Block – Display notice/alerts in the front end \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Block (CVSS 6.4)
- [CVE-2025-26952](https://cve.now/CVE-2025-26952.md): WordPress Business Card Block plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26949](https://cve.now/CVE-2025-26949.md): WordPress Team Section Block plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26947](https://cve.now/CVE-2025-26947.md): WordPress Services Section block plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26945](https://cve.now/CVE-2025-26945.md): WordPress Info Cards plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26939](https://cve.now/CVE-2025-26939.md): WordPress Counters Block plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26938](https://cve.now/CVE-2025-26938.md): WordPress Countdown Timer block plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26937](https://cve.now/CVE-2025-26937.md): WordPress Icon List Block plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26881](https://cve.now/CVE-2025-26881.md): WordPress Sticky Content plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26883](https://cve.now/CVE-2025-26883.md): WordPress Animated Text Block plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-26754](https://cve.now/CVE-2025-26754.md): WordPress Timeline Block plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-22675](https://cve.now/CVE-2025-22675.md): WordPress Alert Box Block plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-13514](https://cve.now/CVE-2024-13514.md): B Slider- Gutenberg Slider Block for WP \<= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode (CVSS 4.3)
- [CVE-2025-24595](https://cve.now/CVE-2025-24595.md): WordPress All Embed – Elementor Addons plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-22787](https://cve.now/CVE-2025-22787.md): WordPress Button Block plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-13156](https://cve.now/CVE-2024-13156.md): HTML5 Video Player – mp4 Video Player Plugin and Block \<= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter (CVSS 6.4)
- [CVE-2025-22815](https://cve.now/CVE-2025-22815.md): WordPress Button Block plugin \<= 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-12560](https://cve.now/CVE-2024-12560.md): Button Block – Get fully customizable & multi-functional buttons \<= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication (CVSS 4.3)
- [CVE-2024-11882](https://cve.now/CVE-2024-11882.md): FAQ And Answers – Create Frequently Asked Questions Area on WP Sites \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-11880](https://cve.now/CVE-2024-11880.md): B Testimonial – testimonial plugin for WP \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-10666](https://cve.now/CVE-2024-10666.md): Easy Twitter Feed – Twitter feeds plugin for WP \<= 1.2.6 - Authenticated (Contributor+) Post Exposure (CVSS 4.3)
- [CVE-2024-10671](https://cve.now/CVE-2024-10671.md): Button Block – Get fully customizable & multi-functional buttons \<= 1.1.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-10667](https://cve.now/CVE-2024-10667.md): Content Slider Block – Create fully functional slider with Gutenberg block \<= 3.1.5 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-10669](https://cve.now/CVE-2024-10669.md): Countdown Timer block – Display the event's date into a timer. \<= 1.2.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-43296](https://cve.now/CVE-2024-43296.md): WordPress HTML5 Video Player plugin \<= 2.5.30 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-47631](https://cve.now/CVE-2024-47631.md): WordPress Logo Carousel – Clients logo carousel for WP plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-7727](https://cve.now/CVE-2024-7727.md): HTML5 Video Player – mp4 Video Player Plugin and Block \<= 2.5.32 - Missing Authorization in multiple functions via h5vp\_ajax\_handler (CVSS 5.3)
- [CVE-2024-7721](https://cve.now/CVE-2024-7721.md): HTML5 Video Player – mp4 Video Player Plugin and Block \<= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 4.3)
- [CVE-2024-43319](https://cve.now/CVE-2024-43319.md): WordPress HTML5 Video Player plugin \<= 2.5.31 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2024-43148](https://cve.now/CVE-2024-43148.md): WordPress StreamCast \<= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-37445](https://cve.now/CVE-2024-37445.md): WordPress HTML5 Audio Player plugin \<= 2.2.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-4398](https://cve.now/CVE-2024-4398.md): HTML5 Audio Player- Best WordPress Audio Player Plugin \<= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2024-0908](https://cve.now/CVE-2024-0908.md): Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page \<= 1.13.4 - Missing Authorization to Information Disclosure (CVSS 5.3)
- [CVE-2024-30432](https://cve.now/CVE-2024-30432.md): WordPress B Slider plugin \<= 1.1.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-30438](https://cve.now/CVE-2024-30438.md): WordPress Print Page block plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-24714](https://cve.now/CVE-2024-24714.md): WordPress Icons Font Loader Plugin \<= 1.1.4 is vulnerable to Arbitrary File Upload (CVSS 7.2)
- [CVE-2024-23508](https://cve.now/CVE-2024-23508.md): WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin \<= 2.1.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-46084](https://cve.now/CVE-2023-46084.md): WordPress Icons Font Loader Plugin \<= 1.1.2 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-5860](https://cve.now/CVE-2023-5860.md): Icons Font Loader \<= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bplugins
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.