Known vulnerabilities in ThemeKraft BuddyForms
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-107658 | BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion | 5.4 Medium | Nov 6, 2026 |
| CVE-2026-107622 | BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter | 9.8 Critical | Nov 6, 2026 |
| CVE-2026-81785 | Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions | 6.5 Medium | Sep 10, 2026 |
| CVE-2025-62973 | Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly… | 5.3 Medium | Oct 27, 2025 |
| CVE-2025-32151 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in… | 7.5 High | Apr 4, 2025 |
| CVE-2024-47377 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themekraft… | 5.9 Medium | Oct 5, 2024 |
| CVE-2024-32830 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms… | 8.6 High | May 17, 2024 |
| CVE-2024-30198 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeKraft… | 5.8 Medium | Mar 27, 2024 |
Other ThemeKraft products
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) 8
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages 4
post_form_registration_form_profile_form_for_user_profiles_and_content_forms 2
TK Google Fonts GDPR Compliant 2
WooBuddy 2
All in One Invite Codes 1
buddypress_woocommerce_my_account_integration 1
Post Form 1
Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions 1