CVE-2021-39327

Summary: CVE-2021-39327 affects the BulletProof Security WordPress plugin up to version 5.1, causing a sensitive information disclosure via a publicly accessible file path disclosure in ~/db_backup_log.txt. This reveals the site’s full path and database backup file paths. Impact (as stated): Atta...

CVE-2022-0590

CVE-2022-0590 affects the BulletProof Security WordPress plugin (before 5.8). The issue arises from the plugin not sanitising and escaping certain settings, enabling high-privilege admins to perform stored XSS even when unfiltered_html is disallowed. The Red Hat/RedHat-related advisory and multip...

CVE-2022-1265

CVE-2022-1265 affects the BulletProof Security WordPress plugin prior to 6.1. The vulnerability arises from insufficient sanitization/escaping of CAPTCHA settings, allowing high-privileged (Admin+) users to perform stored XSS even when unfiltered_html is disallowed. Impact is client-side JavaScri...

CVE-2014-7959

CVE-2014-7959 is a SQL injection vulnerability in the BulletProof Security WordPress plugin prior to version 0.51.1, specifically in admin/htaccess/bpsunlock.php. The flaw allows remote authenticated users to execute arbitrary SQL commands through the tableprefix parameter. The vulnerability is c...

CVE-2014-7958

BulletProof Security (WordPress) plugin

CVE-2014-8749

CVE-2014-8749 concerns a Server-Side Request Forgery (SSRF) in the BulletProof Security WordPress plugin, affecting admin/htaccess/bpsunlock.php. The vulnerability allows an attacker to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter. Affected product/v...

CVE-2015-9230

The CVE-2015-9230 entry relates to the BulletProof Security WordPress plugin. Affected component: admin/db-backup-security/db-backup-security.php. Root cause: cross-site scripting (XSS) vulnerability via the DBTablePrefix parameter in plugin versions prior to 0.52.5, exploitable by remote authent...