Advisories · Technology

themekraft BuddyForms.

Every CVE that names themekraft BuddyForms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-107658 CVE record

CVSS 5.4 Medium

BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion
- themekraft BuddyForms
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2026
CVE-2026-107622 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter
- themekraft BuddyForms
- Privilege escalation
Not analysed yet 6 Nov 2026
CVE-2026-81785 CVE record

CVSS 6.5 Medium

WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability
- Themekraft BuddyForms
- Broken access control
Not analysed yet 10 Sept 2026
CVE-2025-62973 CVE record

CVSS 5.3 Medium

WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability
- Themekraft BuddyForms
- Broken access control
Not analysed yet 27 Oct 2025
CVE-2025-32151 CVE record

CVSS 7.5 High

WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability
- Themekraft BuddyForms
- File inclusion
Not analysed yet 4 Apr 2025
CVE-2024-47377 CVE record

CVSS 5.9 Medium

WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability
- Themekraft BuddyForms
- Cross-site scripting (XSS)
Not analysed yet 5 Oct 2024
CVE-2024-32830 CVE record

CVSS 8.6 High

WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability
- ThemeKraft BuddyForms
- Path traversal
Not analysed yet 17 May 2024
CVE-2024-30198 CVE record

CVSS 5.8 Medium

WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability
- ThemeKraft BuddyForms
- Cross-site scripting (XSS)
Not analysed yet 27 Mar 2024