WordPress security by component
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Plugin description
Post Form – Registration Form – Profile Form for User Profiles creates front-end forms for user registration, profiles, post submission, and collecting user-generated content.
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) (buddyforms) is a WordPress plugin with 18 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; the highest published CVSS base score is 9.8.
Plugin slug:
buddyformsLatest vulnerability
CVE-2026-118101: BuddyForms: Unauthorized modification of other users’ entries
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators. The structured affected range is < 2.10.1.
| Safe version |
|
||
|---|---|---|---|
| Oct 30, 2026 |
CVE-2026-118101
BuddyForms: Unauthorized modification of other users’ entries
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators. The structured affected range is < 2.10.1.
|
2.10.1 |
CVEPending
|
| Oct 30, 2026 |
CVE-2026-118100
BuddyForms: Unauthorized form-configuration disclosure
The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form. The structured affected range is < 2.10.3.
|
2.10.3 |
CVEPending
|
| Sep 10, 2026 |
CVE-2026-81785
BuddyForms permits unauthenticated unauthorized actions
BuddyForms through 2.9.0 has an unauthenticated missing-authorization flaw. A caller can reach a protected operation without permission; the CNA rates integrity and availability impacts as low, with no user interaction required.
|
See mitigation notes |
CVE6.5
|
| Oct 27, 2025 |
CVE-2025-62973
BuddyForms: A security weakness
BuddyForms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
|
| Apr 04, 2025 |
CVE-2025-32151
BuddyForms: Filesystem traversal
BuddyForms is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
|
| Feb 22, 2025 |
CVE-2024-12038
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Cross-site scripting
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
|
| Oct 05, 2024 |
CVE-2024-47377
BuddyForms: Cross-site scripting
BuddyForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
|
| Sep 14, 2024 |
CVE-2024-8246
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Privilege escalation or authentication bypass
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated contributor account. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
|
| Jun 05, 2024 |
CVE-2024-5149
BuddyForms: A security weakness
BuddyForms is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
|
| May 17, 2024 |
CVE-2024-32830
BuddyForms: Filesystem traversal
BuddyForms is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.6
|
| Mar 27, 2024 |
CVE-2024-30198
BuddyForms: Cross-site scripting
BuddyForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.8
|
| Mar 13, 2024 |
CVE-2024-1158
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): A security weakness
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
|
| Mar 07, 2024 |
CVE-2024-1170
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): A security weakness
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE8.2
|
| Mar 07, 2024 |
CVE-2024-1169
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): A security weakness
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
|
| Aug 25, 2023 |
CVE-2023-25981
Buddyforms: Cross-site scripting
Buddyforms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
|
| Mar 16, 2023 |
CVE-2022-38971
Buddyforms: Cross-site scripting
Buddyforms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.7
|
| Feb 23, 2023 |
CVE-2023-26326
BuddyForms: Code execution
BuddyForms is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVEPending
|
| Aug 27, 2019 |
CVE-2018-21003
Buddyforms: SQL injection
Buddyforms is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVEPending
|