GCVE - cpe:2.3:a:themekraft:buddyforms:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:themekraft:buddyforms:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Themekraft (`0a38db96-7a4d-5481-be58-9f9a542a5ea6`)
Product	Buddyforms (`d8ac84b1-ed94-5aa1-b266-3a87070ff9c4`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/buddyforms/buddyforms`	purl2cpe	2026-06-01 10:18:09.812968
`pkg:github/wpplugins/buddyforms`	purl2cpe	2026-06-01 10:18:09.812970

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-62973`	vulnerable	2026-06-08 07:39:17.108316	WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability MEDIUM (5.3) Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through <= 2.9.0. Published: 2025-10-27T01:34:16.394Z Updated: 2026-04-28T18:59:20.923Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/buddyforms/vulnerability/wordpress-buddyforms-plugin-2-9-0-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-32151`	vulnerable	2026-06-08 07:18:59.227017	WordPress BuddyForms Plugin <= 2.9.0 - Local File Inclusion vulnerability HIGH (7.5) Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themekraft BuddyForms buddyforms allows PHP Local File Inclusion.This issue affects BuddyForms: from n/a through <= 2.9.0. Published: 2025-04-04T15:58:37.665Z Updated: 2026-05-12T00:04:09.252Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/buddyforms/vulnerability/wordpress-buddyforms-plugin-2-8-15-local-file-inclusion-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8246`	vulnerable	2026-06-08 07:00:23.361025	Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation HIGH (8.8) The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to set the default role on registration forms. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with a custom role that allows them to register as administrators. Published: 2024-09-14T03:19:27.488Z Updated: 2026-04-08T16:48:24.571Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/40760f60-b81a-447b-a2c8-83c7666ce410?source=cve https://plugins.trac.wordpress.org/changeset/3149760/buddyforms/trunk/includes/admin/form-builder/meta-boxes/metabox-registration.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-5149`	vulnerable	2026-06-08 06:56:15.006816	BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness MEDIUM (6.5) The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification. Published: 2024-06-05T04:32:25.171Z Updated: 2026-04-08T17:13:20.043Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=cve https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.8.9/includes/wp-insert-user.php#L334 https://plugins.trac.wordpress.org/changeset/3101478/buddyforms/trunk/includes/wp-insert-user.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-47377`	vulnerable	2026-06-08 06:48:11.879931	WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability MEDIUM (5.9) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themekraft BuddyForms buddyforms allows Stored XSS.This issue affects BuddyForms: from n/a through <= 2.8.12. Published: 2024-10-05T15:12:04.014Z Updated: 2026-04-28T16:10:19.952Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/buddyforms/vulnerability/wordpress-buddyforms-plugin-2-8-12-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-32830`	vulnerable	2026-06-08 06:37:24.105991	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-30198`	vulnerable	2026-06-08 06:35:29.233577	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1158`	vulnerable	2026-06-08 06:25:39.426103	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-12038`	vulnerable	2026-06-08 06:23:51.043143	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-26326`	vulnerable	2026-06-08 05:57:39.410469	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-21003`	vulnerable	2026-06-08 05:11:28.312573	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.