Known vulnerabilities in the Buddyforms plugin
15 security advisories have been published for the Buddyforms plugin. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.
- BuddyForms - Broken Access Control (CVE-2026-81785) MEDIUM
- Buddyforms - Broken Access Control (CVE-2025-62973) MEDIUM
- Buddyforms - Path Traversal (CVE-2025-32151) HIGH
- Buddyforms - Cross-Site Scripting (XSS) (CVE-2024-12038) MEDIUM
- Buddyforms - Cross-Site Scripting (XSS) (CVE-2024-12037) MEDIUM
- Buddyforms - Cross-Site Scripting (XSS) (CVE-2024-47377) MEDIUM
- Buddyforms - Privilege Escalation (CVE-2024-8246) HIGH
- Buddyforms - Security Vulnerability (CVE-2024-5149) MEDIUM
- Buddyforms - Path Traversal (CVE-2024-32830) HIGH
- Buddyforms - Cross-Site Scripting (XSS) (CVE-2024-30198) MEDIUM
- Buddyforms - Broken Access Control (CVE-2024-1158) MEDIUM
- Buddyforms - Broken Access Control (CVE-2024-1170) HIGH
- Buddyforms - Broken Access Control (CVE-2024-1169) HIGH
- Buddyforms - PHP Object Injection (CVE-2023-26326) CRITICAL
- Buddyforms - SQL Injection (CVE-2018-21003) CRITICAL