{"items":[{"id":"CVE-2026-119365","published":"2026-10-30T16:11:00.627Z","updated":"2026-10-30T17:18:21.690Z","title":"WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Media Player Addons for Elementor – Media Player widget for WP","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-118097","published":"2026-10-29T14:39:07.281Z","updated":"2026-10-29T19:34:06.345Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116849","published":"2026-10-29T14:26:08.716Z","updated":"2026-10-29T16:49:19.673Z","title":"WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-48195","published":"2026-10-29T13:07:16.802Z","updated":"2026-10-29T13:47:35.412Z","title":"WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-52709","published":"2026-10-29T13:03:56.761Z","updated":"2026-10-29T13:47:36.058Z","title":"WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Video Gallery Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-109370","published":"2026-10-28T06:45:19.156Z","updated":"2026-10-29T01:41:51.425Z","title":"Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Document Embedder – let visitors read files without downloading","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-116613","published":"2026-10-28T03:42:54.035Z","updated":"2026-10-29T01:41:55.485Z","title":"Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute","severity":"HIGH","score":7.5,"vendor":"bplugins","product":"Animated Text Block – Add Typing and Looping Text Effects","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-115966","published":"2026-10-26T17:27:49.307Z","updated":"2026-10-26T17:57:32.653Z","title":"WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Typing Text – Give your texts many typing effects","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116400","published":"2026-10-26T17:27:17.642Z","updated":"2026-10-26T17:57:32.849Z","title":"WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116398","published":"2026-10-26T17:26:48.798Z","updated":"2026-10-26T17:57:33.053Z","title":"WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Content Slider Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116395","published":"2026-10-26T16:46:39.501Z","updated":"2026-10-26T17:37:09.389Z","title":"WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"LightBox Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115955","published":"2026-10-26T10:35:04.514Z","updated":"2026-10-26T12:54:33.290Z","title":"WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Advanced Post Block - Post Grid for WordPress block editor","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115956","published":"2026-10-26T10:34:34.613Z","updated":"2026-10-26T12:54:33.447Z","title":"WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Panorama Viewer – 360 Degree Image + Video Viewer","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115961","published":"2026-10-26T10:34:10.476Z","updated":"2026-10-26T12:54:33.589Z","title":"WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115613","published":"2026-10-26T09:54:36.992Z","updated":"2026-10-26T10:13:37.674Z","title":"WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Image Gallery block – Create and display photo gallery/photo album.","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-62037","published":"2026-10-10T19:35:34.938Z","updated":"2026-10-11T11:42:58.866Z","title":"WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Document Embedder","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62034","published":"2026-10-10T19:35:33.484Z","updated":"2026-10-11T11:42:59.001Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62030","published":"2026-10-10T19:35:30.447Z","updated":"2026-10-11T11:42:57.453Z","title":"WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-62027","published":"2026-10-10T19:35:29.582Z","updated":"2026-10-11T11:42:59.155Z","title":"WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Team Section Block","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62044","published":"2026-10-10T17:00:09.638Z","updated":"2026-10-11T12:13:37.319Z","title":"WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"Super Video Player","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-62028","published":"2026-10-09T12:14:54.653Z","updated":"2026-10-11T12:13:41.276Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-62039","published":"2026-10-09T11:44:04.748Z","updated":"2026-10-11T11:42:55.643Z","title":"WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Html5 Audio Player","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-42634","published":"2026-10-06T08:34:59.948Z","updated":"2026-10-06T10:31:30.659Z","title":"WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Video Background Block – Use video as background in the section.","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-104400","published":"2026-10-05T08:07:32.702Z","updated":"2026-10-05T14:05:02.111Z","title":"WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-102378","published":"2026-10-01T14:34:06.250Z","updated":"2026-10-01T14:57:37.004Z","title":"WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Parallax Section block","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-5626","published":"2026-07-29T02:31:39.742Z","updated":"2026-07-29T14:24:16.632Z","title":"Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Survey Form Block – collect answers and insights from your audience","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-27422","published":"2026-07-23T11:17:58.367Z","updated":"2026-09-23T08:48:56.815Z","title":"WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bPlugins","product":"YT Player","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57647","published":"2026-06-26T14:53:19.663Z","updated":"2026-06-26T15:39:08.759Z","title":"WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"bPlugins","product":"Panorama Viewer – 360 Degree Image + Video Viewer","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-57323","published":"2026-06-26T14:53:01.979Z","updated":"2026-06-26T16:45:33.682Z","title":"WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.8,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-56063","published":"2026-06-26T14:52:50.015Z","updated":"2026-06-26T16:55:45.464Z","title":"WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability","severity":"HIGH","score":8.3,"vendor":"bPlugins","product":"MailChimp Block","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-11402","published":"2026-06-18T05:34:26.069Z","updated":"2026-06-18T12:32:58.800Z","title":"Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Services Section Block – Showcase Service Details in Grid or Columns","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-39579","published":"2026-06-15T20:18:07.393Z","updated":"2026-06-15T22:22:02.036Z","title":"WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-53736","published":"2026-06-10T20:39:41.827Z","updated":"2026-06-11T16:15:11.999Z","title":"Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action","severity":"MEDIUM","score":5.1,"vendor":"bplugins","product":"Easy Twitter Feeds","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-24520","published":"2026-05-26T19:31:35.457Z","updated":"2026-05-27T10:42:51.509Z","title":"WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bPlugins","product":"Tiktok Feed","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27416","published":"2026-05-07T08:38:15.411Z","updated":"2026-05-07T12:02:28.345Z","title":"WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-6446","published":"2026-05-02T04:27:46.053Z","updated":"2026-05-04T14:59:54.515Z","title":"My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action","severity":"MEDIUM","score":5.4,"vendor":"bplugins","product":"My Social Feeds – Social Feeds Embedder Plugin for WordPress","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2024-13362","published":"2026-05-01T05:29:54.148Z","updated":"2026-05-01T13:23:26.723Z","title":"Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","severity":"MEDIUM","score":6.1,"vendor":"sebet","product":"Go Fetch Jobs (for WP Job Manager)","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-40729","published":"2026-04-15T10:21:33.661Z","updated":"2026-04-29T09:52:04.755Z","title":"WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bPlugins","product":"3D viewer – Embed 3D Models","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-32489","published":"2026-03-25T16:14:58.411Z","updated":"2026-04-29T09:52:00.331Z","title":"WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-4120","published":"2026-03-19T06:46:14.030Z","updated":"2026-04-08T16:42:57.427Z","title":"Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Info Cards – Add Text and Media in Card Layouts","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-32416","published":"2026-03-13T11:42:15.425Z","updated":"2026-04-29T09:51:59.108Z","title":"WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-32359","published":"2026-03-13T11:42:04.157Z","updated":"2026-04-29T09:51:57.977Z","title":"WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Icon List Block","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-1228","published":"2026-02-06T02:23:38.677Z","updated":"2026-04-08T17:24:31.746Z","title":"Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines)","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-1294","published":"2026-02-05T09:13:45.563Z","updated":"2026-04-08T17:02:39.612Z","title":"All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint","severity":"HIGH","score":7.2,"vendor":"bplugins","product":"All In One Image Viewer Block – Gutenberg block to create image viewer with hyperlink","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-1389","published":"2026-01-28T07:27:34.729Z","updated":"2026-04-08T16:54:55.705Z","title":"Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Document Embedder – Embed PDFs, Word, Excel, and Other Files","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-24565","published":"2026-01-23T14:28:55.844Z","updated":"2026-04-28T16:14:49.310Z","title":"WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Accordion","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-24383","published":"2026-01-22T16:52:46.919Z","updated":"2026-04-28T16:14:48.420Z","title":"WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-0833","published":"2026-01-17T06:42:19.058Z","updated":"2026-04-08T16:57:17.071Z","title":"Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Team Section Block – Showcase Team Members with Layout Options","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-13999","published":"2025-12-19T06:48:23.714Z","updated":"2025-12-19T15:32:52.930Z","title":"HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery","severity":"HIGH","score":7.2,"vendor":"bplugins","product":"HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-60079","published":"2025-12-18T07:22:06.840Z","updated":"2026-04-28T16:13:54.305Z","title":"WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Parallax Section block","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-66110","published":"2025-11-21T12:30:05.216Z","updated":"2026-04-28T16:14:17.075Z","title":"WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bPlugins","product":"Tiktok Feed","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-12376","published":"2025-11-18T13:54:50.042Z","updated":"2026-04-08T16:49:08.188Z","title":"Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Icon List Block – Add Icon-Based Lists with Custom Styles","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-54711","published":"2025-11-06T15:54:14.029Z","updated":"2026-04-28T16:13:35.837Z","title":"WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Info Cards","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-49900","published":"2025-11-06T15:53:54.586Z","updated":"2026-04-28T20:23:31.818Z","title":"WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"bPlugins","product":"Advanced scrollbar","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-49394","published":"2025-11-06T15:53:53.230Z","updated":"2026-04-28T16:13:03.451Z","title":"WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Image Gallery block – Create and display photo gallery/photo album.","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-12384","published":"2025-11-05T06:35:02.300Z","updated":"2026-04-08T17:31:13.437Z","title":"Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation","severity":"HIGH","score":8.6,"vendor":"bplugins","product":"Document Embedder – Embed PDFs, Word, Excel, and Other Files","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2025-12388","published":"2025-11-05T06:35:01.390Z","updated":"2026-04-08T17:23:27.070Z","title":"B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Carousel Block – Responsive Image and Content Carousel","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-62007","published":"2025-10-22T14:32:47.880Z","updated":"2026-04-28T18:46:27.269Z","title":"WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"bPlugins","product":"Voice Feedback","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-10735","published":"2025-10-01T03:25:23.454Z","updated":"2026-04-08T16:52:39.004Z","title":"Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery","severity":"MEDIUM","score":4,"vendor":"bplugins","product":"Block for Mailchimp – Add Email Subscription Forms and Collect Leads","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-9203","published":"2025-09-17T06:17:48.156Z","updated":"2026-04-08T16:35:57.655Z","title":"Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Media Player Addons for Elementor – Audio and Video Widgets for Elementor","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-54734","published":"2025-08-28T12:37:39.117Z","updated":"2026-04-28T16:13:36.736Z","title":"WordPress B Slider Plugin <= 1.1.30 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.8,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-54710","published":"2025-08-28T12:37:34.462Z","updated":"2026-04-28T16:13:35.876Z","title":"WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Tiktok Feed","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-8676","published":"2025-08-15T02:24:23.998Z","updated":"2026-04-08T17:19:55.363Z","title":"B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"bSlider – Create Responsive Image, Post, Product, and Video Sliders","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2025-8680","published":"2025-08-15T02:24:23.123Z","updated":"2026-04-08T17:14:47.839Z","title":"B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"bSlider – Create Responsive Image, Post, Product, and Video Sliders","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2025-54708","published":"2025-08-14T18:21:47.472Z","updated":"2026-05-12T00:31:15.824Z","title":"WordPress B Blocks Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-54694","published":"2025-08-14T10:34:52.521Z","updated":"2026-04-28T16:13:34.992Z","title":"WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-8418","published":"2025-08-12T06:42:42.438Z","updated":"2026-04-08T17:28:26.403Z","title":"B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation","severity":"HIGH","score":8.8,"vendor":"bplugins","product":"bSlider – Create Responsive Image, Post, Product, and Video Sliders","kev":false,"epss":0.00676,"kevAdded":null},{"id":"CVE-2025-8059","published":"2025-08-12T04:25:40.466Z","updated":"2026-04-08T16:35:34.334Z","title":"B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function","severity":"CRITICAL","score":9.8,"vendor":"bplugins","product":"bBlocks – Essential Gutenberg Blocks & Patterns Collection","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-54051","published":"2025-07-16T10:36:52.703Z","updated":"2026-04-28T16:13:29.788Z","title":"WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"LightBox Block","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-27326","published":"2025-07-04T08:42:09.296Z","updated":"2026-04-28T16:11:48.252Z","title":"WordPress Video Gallery Block plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Video Gallery Block","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-2579","published":"2025-04-24T08:23:50.232Z","updated":"2026-04-08T17:17:47.717Z","title":"Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Lottie Player – Add Interactive Lottie Animations with Block Support","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-39524","published":"2025-04-16T12:45:49.051Z","updated":"2026-04-28T16:12:34.000Z","title":"WordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Html5 Audio Player","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-32173","published":"2025-04-04T15:58:52.948Z","updated":"2026-04-28T16:12:18.196Z","title":"WordPress B Blocks plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2024-13731","published":"2025-03-25T08:22:15.605Z","updated":"2026-04-08T17:26:18.342Z","title":"Alert Box Block – Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Block","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Alert Box Block – Display Custom Alerts and Messages","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-26952","published":"2025-02-25T14:17:56.674Z","updated":"2026-04-28T16:11:44.803Z","title":"WordPress Business Card Block plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Business Card Block","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-26949","published":"2025-02-25T14:17:56.463Z","updated":"2026-04-28T16:11:44.794Z","title":"WordPress Team Section Block plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Team Section Block","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-26947","published":"2025-02-25T14:17:56.160Z","updated":"2026-04-28T16:11:44.776Z","title":"WordPress Services Section block plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Services Section block","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-26945","published":"2025-02-25T14:17:55.883Z","updated":"2026-04-28T16:11:44.690Z","title":"WordPress Info Cards plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Info Cards","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-26939","published":"2025-02-25T14:17:55.504Z","updated":"2026-04-28T16:11:44.350Z","title":"WordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Counters Block","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-26938","published":"2025-02-25T14:17:55.295Z","updated":"2026-04-28T16:11:44.304Z","title":"WordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Countdown Timer","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-26937","published":"2025-02-25T14:17:55.124Z","updated":"2026-04-28T16:11:44.452Z","title":"WordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Icon List Block","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-26881","published":"2025-02-25T14:17:51.599Z","updated":"2026-04-28T16:11:41.346Z","title":"WordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Sticky Content","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-26883","published":"2025-02-24T14:49:05.550Z","updated":"2026-04-28T16:11:41.968Z","title":"WordPress Animated Text Block plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Animated Text Block","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2025-26754","published":"2025-02-17T11:38:13.566Z","updated":"2026-04-28T16:11:40.084Z","title":"WordPress Timeline Block plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Timeline Block","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-22675","published":"2025-02-04T14:21:58.225Z","updated":"2026-04-28T16:11:04.476Z","title":"WordPress Alert Box Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Alert Box Block – Display notice/alerts in the front end","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2024-13514","published":"2025-02-04T07:21:00.282Z","updated":"2026-04-08T17:15:59.690Z","title":"B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"bSlider – Create Responsive Image, Post, Product, and Video Sliders","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-24595","published":"2025-01-24T17:24:27.647Z","updated":"2026-04-28T16:11:29.394Z","title":"WordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"All Embed – Elementor Addons","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-22787","published":"2025-01-15T15:23:09.858Z","updated":"2026-04-28T16:11:07.237Z","title":"WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2024-13156","published":"2025-01-14T08:23:14.833Z","updated":"2026-04-08T17:28:46.493Z","title":"HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"HTML5 Video Player – Embed and Play Videos in Custom Player","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2025-22815","published":"2025-01-09T15:39:02.754Z","updated":"2026-05-11T22:37:10.639Z","title":"WordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2024-12560","published":"2024-12-19T07:05:47.462Z","updated":"2026-04-08T17:14:51.885Z","title":"Button Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Button Block – Design Stylish, Interactive, and Multi-Functional Buttons","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2024-11882","published":"2024-12-12T05:24:18.791Z","updated":"2026-04-08T16:35:44.352Z","title":"FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"Awesome FAQ  – Modern Accordion, Tabs,Responsive & Super Fast FAQ Builder.","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2024-11880","published":"2024-12-04T08:22:47.289Z","updated":"2026-04-08T17:30:58.069Z","title":"B Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"B Testimonial – Customer Testimonials in Custom Layouts","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2024-10666","published":"2024-11-22T05:33:43.057Z","updated":"2026-04-08T17:27:13.430Z","title":"Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Feeds for Twitter – Embed Social Media Posts with Live Updates","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2024-10671","published":"2024-11-21T05:33:51.413Z","updated":"2026-04-08T17:10:57.745Z","title":"Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Button Block – Design Stylish, Interactive, and Multi-Functional Buttons","kev":false,"epss":0.00513,"kevAdded":null},{"id":"CVE-2024-10667","published":"2024-11-09T04:32:27.401Z","updated":"2026-04-08T17:20:22.728Z","title":"Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Content Slider Block – Slide Through Text or Media Content","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2024-10669","published":"2024-11-09T04:32:26.918Z","updated":"2026-04-08T16:42:18.176Z","title":"Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"Countdown Timer Block – Animated Countdown for Events or Launches","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2022-4974","published":"2024-10-16T06:43:30.014Z","updated":"2026-04-08T16:46:54.861Z","title":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","severity":"MEDIUM","score":6.3,"vendor":"dashlabsltd","product":"YASR – Yet Another Star Rating Plugin for WordPress","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2024-47631","published":"2024-10-05T13:11:14.310Z","updated":"2026-04-28T16:10:20.615Z","title":"WordPress Logo Carousel – Clients logo carousel for WP plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Logo Carousel – Clients logo carousel for WP","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2024-7727","published":"2024-09-11T04:31:20.937Z","updated":"2026-04-08T17:06:47.090Z","title":"HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler","severity":"MEDIUM","score":5.3,"vendor":"bplugins","product":"HTML5 Video Player – Embed and Play Videos in Custom Player","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2024-7721","published":"2024-09-11T04:31:20.309Z","updated":"2026-04-08T16:59:31.364Z","title":"HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"MEDIUM","score":4.3,"vendor":"bplugins","product":"HTML5 Video Player – Embed and Play Videos in Custom Player","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2024-43148","published":"2024-08-12T22:15:03.813Z","updated":"2026-04-28T16:10:09.516Z","title":"WordPress StreamCast  <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2024-37445","published":"2024-07-22T08:14:31.004Z","updated":"2026-04-28T16:09:59.039Z","title":"WordPress HTML5 Audio Player plugin <= 2.2.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Html5 Audio Player","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2024-4398","published":"2024-05-10T07:33:39.311Z","updated":"2026-04-08T17:22:09.083Z","title":"HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"MEDIUM","score":6.4,"vendor":"bplugins","product":"HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2024-0908","published":"2024-05-02T16:52:24.157Z","updated":"2026-04-08T17:06:37.650Z","title":"Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure","severity":"MEDIUM","score":5.3,"vendor":"bplugins","product":"Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters","kev":false,"epss":0.00516,"kevAdded":null},{"id":"CVE-2024-30432","published":"2024-03-29T17:31:15.099Z","updated":"2026-04-28T16:09:23.391Z","title":"WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Slider - Slider for your block editor","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2024-30438","published":"2024-03-29T17:20:33.372Z","updated":"2026-04-28T16:09:23.972Z","title":"WordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Print Page block","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2024-23508","published":"2024-01-31T15:21:17.373Z","updated":"2026-04-28T16:09:09.741Z","title":"WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"PDF Poster – PDF Embedder Plugin for WordPress","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2023-5860","published":"2023-11-02T11:00:50.449Z","updated":"2026-04-08T16:36:28.849Z","title":"Icons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload","severity":"HIGH","score":7.2,"vendor":"bplugins","product":"Icons Font Loader – Load Web Fonts and Icon Libraries","kev":false,"epss":0.01293,"kevAdded":null}]}