Themekraft CVEs
25 CVEs and advisories name Themekraft as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-127115BuddyForms <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode
- CVE-2026-107658BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion
- CVE-2026-107622BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter
- CVE-2026-81785WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability
- CVE-2025-62973WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability
- CVE-2025-32151WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability
- CVE-2025-1780BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update
- CVE-2024-13358BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
- CVE-2024-12038Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode
- CVE-2024-12037Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks
- CVE-2024-47377WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-8246Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation
- CVE-2024-35726WordPress WooBuddy plugin <= 3.4.19 - Broken Access Control vulnerability
- CVE-2024-5149BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness
- CVE-2024-32830WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability
- CVE-2024-32603WordPress WooBuddy plugin <= 3.4.20 - PHP Object Injection vulnerability
- CVE-2024-30198WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-2025BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request
- CVE-2024-1158Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization
- CVE-2024-1169Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload
- CVE-2024-1170Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion
- CVE-2023-5823WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25981WordPress BuddyForms Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2022-38971WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)