Bplugins vulnerabilities, page 4
107 vulnerabilities
Known vulnerabilities in Bplugins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 79 products.
CVE-2024-7727bpluginshtml5_video_player+2
EPSS score0.39%
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.CVE-2024-5522bpluginshtml5_video_player+2EPSS score2.62%
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacksCVE-2024-10671bpluginsbutton_block+2EPSS score0.51%
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.CVE-2024-10669bpluginscountdown timer block – animated countdown for events or launches+1EPSS score0.31%
The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.CVE-2024-10667bpluginscontent slider block – slide through text or media content+1EPSS score0.31%
The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.CVE-2024-10666bpluginsfeeds for twitter – embed social media posts with live updates+1EPSS score0.45%
The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.CVE-2024-24714bplugins llcicons font loader+2EPSS score0.60%
Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.CVE-2024-30432bpluginsb slider - slider for your block editor+1EPSS score0.33%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12.CVE-2024-30438bpluginsprint page block+1EPSS score0.35%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue affects Print Page block: from n/a through 1.0.8.CVE-2024-12560bpluginsbutton_block+2EPSS score0.37%
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.CVE-2024-23508bpluginspdf_poster+2EPSS score0.33%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.CVE-2026-40729bplugins3d viewer – embed 3d models+1EPSS score0.23%
Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.CVE-2026-1389bpluginsdocument embedder – embed pdfs, word, excel, and other files+1EPSS score0.22%
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the 'bplde_save_document_library', 'bplde_get_single', and 'bplde_delete_document_library' AJAX actions. This makes it possible for authenticated attackers, with Author-level access and above, to read, modify, and delete Document Library entries created by other users, including administrators, via the 'id' parameter.CVE-2026-1228bpluginstimeline block – beautiful timeline builder for wordpress (vertical & horizontal timelines)+1EPSS score0.21%
The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgb_shortcode() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to disclose private timeline content via the id attribute supplied to the 'timeline_block' shortcode.CVE-2026-1294bpluginsall in one image viewer block – gutenberg block to create image viewer with hyperlink+1EPSS score0.33%
The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.CVE-2026-62039bpluginshtml5_audio_player+1EPSS score0.13%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.CVE-2026-62030bpluginsstreamcast+1EPSS score0.19%
Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.CVE-2026-62034bpluginsbefore after image comparison – image comparison for wp+1EPSS score0.18%
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.CVE-2026-62028bpluginsbefore after image comparison – image comparison for wp+1EPSS score0.14%
Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.CVE-2026-62037bpluginsdocument_embedder+1EPSS score0.18%
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.