# cve.now: Themekraft

The newest entries naming Themekraft as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-127115](https://cve.now/CVE-2026-127115.md): BuddyForms \<= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of \[bf\_login\_form\] Shortcode (CVSS 5.4)
- [CVE-2026-107658](https://cve.now/CVE-2026-107658.md): BuddyForms \<= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf\_post\_type' Parameter via Post-Type Confusion (CVSS 5.4)
- [CVE-2026-107622](https://cve.now/CVE-2026-107622.md): BuddyForms \<= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf\_post\_type' Parameter (CVSS 9.8)
- [CVE-2026-81785](https://cve.now/CVE-2026-81785.md): WordPress BuddyForms plugin \<= 2.9.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-62973](https://cve.now/CVE-2025-62973.md): WordPress BuddyForms plugin \<= 2.10.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-32151](https://cve.now/CVE-2025-32151.md): WordPress BuddyForms plugin \<= 2.10.2 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-1780](https://cve.now/CVE-2025-1780.md): BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \<= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update (CVSS 4.3)
- [CVE-2024-13358](https://cve.now/CVE-2024-13358.md): BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \<= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3)
- [CVE-2024-12038](https://cve.now/CVE-2024-12038.md): Frontend Content Forms for User Submissions (UGC) \<= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms\_nav' Shortcode (CVSS 6.4)
- [CVE-2024-12037](https://cve.now/CVE-2024-12037.md): Frontend Content Forms for User Submissions (UGC) \<= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-47377](https://cve.now/CVE-2024-47377.md): WordPress BuddyForms plugin \<= 2.8.12 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-8246](https://cve.now/CVE-2024-8246.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.11 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8)
- [CVE-2024-35726](https://cve.now/CVE-2024-35726.md): WordPress WooBuddy plugin \<= 3.4.19 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-5149](https://cve.now/CVE-2024-5149.md): BuddyForms \<= 2.8.9 - Email Verification Bypass due to Insufficient Randomness (CVSS 6.5)
- [CVE-2024-32830](https://cve.now/CVE-2024-32830.md): WordPress buddyforms plugin \<= 2.8.8- Arbitrary File Read and SSRF vulnerability (CVSS 8.6)
- [CVE-2024-32603](https://cve.now/CVE-2024-32603.md): WordPress WooBuddy plugin \<= 3.4.20 - PHP Object Injection vulnerability (CVSS 8.5)
- [CVE-2024-30198](https://cve.now/CVE-2024-30198.md): WordPress Buddyforms plugin \<= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 5.8)
- [CVE-2024-2025](https://cve.now/CVE-2024-2025.md): BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \<= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get\_simple\_request (CVSS 8.8)
- [CVE-2024-1158](https://cve.now/CVE-2024-1158.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.7 - Missing Authorization (CVSS 4.3)
- [CVE-2024-1169](https://cve.now/CVE-2024-1169.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.7 - Missing Authorization to Unauthenticated Media Upload (CVSS 7.5)
- [CVE-2024-1170](https://cve.now/CVE-2024-1170.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion (CVSS 8.2)
- [CVE-2023-5823](https://cve.now/CVE-2023-5823.md): WordPress TK Google Fonts GDPR Compliant Plugin \<= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-25981](https://cve.now/CVE-2023-25981.md): WordPress BuddyForms Plugin \<= 2.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2022-38971](https://cve.now/CVE-2022-38971.md): WordPress BuddyForms Plugin \<= 2.7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themekraft
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.