Skip to content
Noroxi

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)

buddyforms · plugin

Known security vulnerabilities for Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC). Find out in seconds which version runs on your site with WP Lens.

16 known vulnerabilities

1 critical · 1 with public exploit code · latest Sep 10, 2026

Vulnerabilities

  • CVE-2018-21003

    The buddyforms plugin before 2.2.8 for WordPress has SQL injection.

    Critical 9.8

  • CVE-2025-32151

    WordPress BuddyForms Plugin <= 2.9.0 - Local File Inclusion vulnerability

    High 8.8

  • CVE-2024-8246

    Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Priv

    High 8.8

  • CVE-2024-1170

    Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthent

    High 8.2

  • CVE-2024-32830

    WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability

    High 7.5

  • CVE-2024-1169

    Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthent

    High 7.5

  • CVE-2026-81785

    WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2024-12037

    Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2024-30198

    WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-12038

    Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode

    Medium 5.4

  • CVE-2024-47377

    WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2023-25981

    WordPress BuddyForms Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2022-38971

    WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2025-62973

    WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-5149

    BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness

    Medium 5.3

  • CVE-2024-1158

    Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization

    Medium 4.3

← Back to directory