CVE-2024-1169

CVE-2024-1169 affects the BuddyForms Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) WordPress plugin. All versions up to and including 2.8.7 are vulnerable due to a missing capability check in buddyforms_upload_handle_dropped_med...

CVE-2024-1170

The CVE-2024-1170 entry concerns the BuddyForms (Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions) WordPress plugin. A missing capability check in the handle_deleted_media function allows unauthenticated attackers to delete arbitrary med...

CVE-2023-25981

CVE-2023-25981 is a Stored Cross-Site Scripting (XSS) vulnerability in WordPress BuddyForms plugin versions up to 2.8.1. The issue arises from insufficient input escaping in the Post Form workflow, enabling an attacker with Contributor privileges to inject scripts into a site. A fixed version is ...