themekraft vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 202412
3. 20256
4. 20263

Newest CVEs

• CVE-2026-107658

  BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

  themekraft · BuddyForms

  Medium5.4
• CVE-2026-107622

  BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

  themekraft · BuddyForms

  Critical9.8
• CVE-2026-81785

  WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability

  Themekraft · BuddyForms

  Medium6.5
• CVE-2025-62973

  WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability

  Themekraft · BuddyForms

  Medium5.3
• CVE-2025-32151

  WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability

  Themekraft · BuddyForms

  High7.5
• CVE-2025-1780

  BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update

  themekraft · BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages

  Medium4.3
• CVE-2024-13358

  BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update

  themekraft · BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages

  Medium4.3
• CVE-2024-12038

  Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode

  themekraft · Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)

  Medium6.4
• CVE-2024-12037

  Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

  themekraft · Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)

  Medium6.4
• CVE-2022-4974

  Freemius SDK <= 2.4.2 - Missing Authorization Checks

  dashlabsltd · YASR – Yet Another Star Rating Plugin for WordPress

  Medium6.3