Bplugins vulnerabilities
107 vulnerabilities
Known vulnerabilities in Bplugins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 79 products.
Products
50 of 79- Html5 Video Player6 vulnerabilities
- B Blocks5 vulnerabilities
- Button Block5 vulnerabilities
- Html5 Audio Player5 vulnerabilities
- Bslider – Create Responsive Image, Post, Product, And Video Sliders4 vulnerabilities
- Document Embedder3 vulnerabilities
- Html5 Audio Player – The Ultimate No Code Podcast, MP3 & Audio Player3 vulnerabilities
- Html5 Video Player – Embed And Play Videos In Custom Player3 vulnerabilities
- Icons Font Loader3 vulnerabilities
- Pdf Poster3 vulnerabilities
- Tiktok Feed3 vulnerabilities
- B Slider2 vulnerabilities
- Bblocks – Essential Gutenberg Blocks & Patterns Collection2 vulnerabilities
- Before After Image Comparison – Image Comparison For WP2 vulnerabilities
- Button Block – Design Stylish, Interactive, And Multi Functional Buttons2 vulnerabilities
- Document Embedder – Embed Pdfs, Word, Excel, And Other Files2 vulnerabilities
- Icon List Block2 vulnerabilities
- Info Cards2 vulnerabilities
- Parallax Section Block2 vulnerabilities
- Streamcast2 vulnerabilities
- Team Section Block2 vulnerabilities
- 3D Viewer – Display Interactive 3D Models1 vulnerabilities
- 3D Viewer – Embed 3D Models1 vulnerabilities
- Advanced Post Block – Showcase Posts With Grid, List, Card Layouts And Filters1 vulnerabilities
- Advanced Scrollbar1 vulnerabilities
- Advanced Scrollbar – Custom Scrollbar Styling And Behavior1 vulnerabilities
- Alert Box Block – Display Custom Alerts And Messages1 vulnerabilities
- Alert Box Block – Display Notice/Alerts In The Front End1 vulnerabilities
- All Embed – Elementor Addons1 vulnerabilities
- All In One Image Viewer Block – Gutenberg Block To Create Image Viewer With Hyperlink1 vulnerabilities
- Animated Text Block1 vulnerabilities
- Awesome FAQ – Modern Accordion, Tabs,Responsive & Super Fast FAQ Builder.1 vulnerabilities
- B Accordion1 vulnerabilities
- B Slider Slider For Your Block Editor1 vulnerabilities
- B Testimonial – Customer Testimonials In Custom Layouts1 vulnerabilities
- Block For Mailchimp – Add Email Subscription Forms And Collect Leads1 vulnerabilities
- Business Card Block1 vulnerabilities
- Carousel Block – Responsive Image And Content Carousel1 vulnerabilities
- Content Slider Block – Slide Through Text Or Media Content1 vulnerabilities
- Countdown Timer1 vulnerabilities
- Countdown Timer Block – Animated Countdown For Events Or Launches1 vulnerabilities
- Counters Block1 vulnerabilities
- Document Viewer – Embed Word, Excel, Powerpoint & Pdfs Instantly1 vulnerabilities
- Easy Twitter Feed1 vulnerabilities
- Easy Twitter Feeds1 vulnerabilities
- Feeds For Twitter – Embed Social Media Posts With Live Updates1 vulnerabilities
- Flash & Html5 Video1 vulnerabilities
- Icon List Block – Add Icon Based Lists With Custom Styles1 vulnerabilities
- Icons Font Loader – Load Web Fonts And Icon Libraries1 vulnerabilities
- Image Gallery Block – Create And Display Photo Gallery/Photo Album.1 vulnerabilities
CVE-2021-24415bpluginspolo_video_gallery+2
EPSS score0.58%
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcodeCVE-2021-24868bpluginsdocument_embedder+1EPSS score0.89%
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.CVE-2021-24413bpluginseasy_twitter_feed+2EPSS score0.65%
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcodeCVE-2021-24412bpluginshtml5_audio_player+2EPSS score0.65%
The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcodeCVE-2021-24775bpluginsdocument_embedder+1EPSS score1.33%
The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.CVE-2021-24416bpluginsstreamcast_radio_player+2EPSS score0.58%
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcodeCVE-2025-54710bpluginstiktok feed+1EPSS score0.24%
Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tiktok Feed: from n/a through <= 1.0.21.CVE-2025-54051bpluginslightbox block+1EPSS score0.20%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.CVE-2025-54734bpluginsb slider+1EPSS score0.22%
Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Slider: from n/a through <= 1.1.30.CVE-2025-54708bpluginsb blocks+1EPSS score0.21%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issue affects B Blocks: from n/a through <= 2.0.5.CVE-2025-54694bpluginsbutton_block+1EPSS score0.14%
Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through <= 1.2.0.CVE-2025-54711bpluginsinfo cards+1EPSS score0.29%
Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info Cards: from n/a through <= 1.0.11.CVE-2025-2579bpluginslottie player – add interactive lottie animations with block support+1EPSS score0.31%
The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.CVE-2025-13999bpluginshtml5 audio player – the ultimate no-code podcast, mp3 & audio player+1EPSS score0.24%
The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2.4.0 up to, and including, 2.5.1 via the getIcyMetadata() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.CVE-2025-62007bpluginsvoice feedback+1EPSS score0.38%
Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through <= 1.0.3.CVE-2025-26949bpluginsteam section block+1EPSS score0.26%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.CVE-2025-26754bpluginstimeline block+1EPSS score0.23%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Stored XSS.This issue affects Timeline Block: from n/a through <= 1.1.1.CVE-2025-26938bpluginscountdown timer+1EPSS score0.28%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS.This issue affects Countdown Timer: from n/a through <= 1.2.6.CVE-2025-26945bpluginsinfo cards+1EPSS score0.26%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This issue affects Info Cards: from n/a through <= 1.0.5.CVE-2025-26937bpluginsicon list block+1EPSS score0.26%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.