CveMateVulnerability intelligence

Bplugins vulnerabilities, page 5

107 vulnerabilities

Known vulnerabilities in Bplugins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 79 products.

CVE-2026-62044bpluginssuper video player+111d ago10-10-2026 17:00

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.CVE-2026-62027bpluginsteam section block+111d ago10-10-2026 19:35

Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.CVE-2026-11402bpluginsservices section block – showcase service details in grid or columns+14mo ago18-06-2026 05:34

The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists inside HTML comments in post_content, bypassing wp_kses_post sanitization at save time, and executes via both the primary service link anchor and a secondary title-wrapped anchor when the linkIn option is set to 'title'.CVE-2026-42634bpluginsvideo background block – use video as background in the section.+116d ago06-10-2026 08:34

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.CVE-2026-102378bpluginsparallax section block+120d ago01-10-2026 14:34

Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.CVE-2026-0833bpluginsteam section block – showcase team members with layout options+19mo ago17-01-2026 06:42

The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user-supplied social network link URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-4120bpluginsinfo cards – add text and media in card layouts+17mo ago19-03-2026 06:46

The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the lack of javascript: protocol filtering. The block's render.php passes all attributes as JSON to the frontend via a data-attributes HTML attribute using esc_attr(wp_json_encode()), which prevents HTML attribute injection but does not validate URL protocols within the JSON data. The client-side view.js then renders the btnUrl value directly as an href attribute on anchor elements without any protocol sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject javascript: URLs that execute arbitrary web scripts when a user clicks the rendered button link.CVE-2026-39579bpluginsb blocks+14mo ago15-06-2026 20:18

Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.CVE-2026-53736bpluginseasy twitter feeds4mo ago10-06-2026 20:39

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.CVE-2026-56063bpluginsmailchimp block+13mo ago26-06-2026 14:52

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-27422bpluginsyt player+13mo ago23-07-2026 11:17

Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.CVE-2026-27416bpluginspdf_poster+15mo ago07-05-2026 08:38

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.CVE-2026-57323bpluginsflash & html5 video+13mo ago26-06-2026 14:53

Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.CVE-2026-57647bpluginspanorama viewer – 360 degree image + video viewer+13mo ago26-06-2026 14:53

Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.CVE-2026-5626bpluginssurvey form block – collect answers and insights from your audience+12mo ago29-07-2026 02:31

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all survey submission data and column metadata.CVE-2026-104400bpluginsb blocks+117d ago05-10-2026 08:07

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.CVE-2026-24383bpluginsb slider+19mo ago22-01-2026 16:52

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issue affects B Slider: from n/a through <= 2.0.6.CVE-2026-24520bpluginstiktok feed+14mo ago26-05-2026 19:31

Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24.CVE-2026-24565bpluginsb accordion+19mo ago23-01-2026 14:28

Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects B Accordion: from n/a through <= 2.0.2.CVE-2026-32359bpluginsicon list block+17mo ago13-03-2026 11:42

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.2.3.