Bplugins vulnerabilities
114 CVEs and advisories name Bplugins as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56063WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability
- CVE-2026-11402Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute
- CVE-2026-39579WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability
- CVE-2026-53736Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action
- CVE-2026-24520WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability
- CVE-2026-27416WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability
- CVE-2026-6446My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action
- CVE-2024-13362Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
- CVE-2026-40729WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability
- CVE-2026-32489WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability
- CVE-2026-4120Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
- CVE-2026-32416WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability
- CVE-2026-32359WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-1228Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute
- CVE-2026-1294All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
- CVE-2026-1389Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
- CVE-2026-24565WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability
- CVE-2026-24383WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-0833Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link
- CVE-2025-13999HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery
- CVE-2025-60079WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability
- CVE-2025-66110WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability
- CVE-2025-12376Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2025-54711WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability
- CVE-2025-49900WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability
- CVE-2025-49394WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability
- CVE-2025-12384Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
- CVE-2025-12388B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2025-62007WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability
- CVE-2025-10735Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery