Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

bplugins — Vulnerabilities & Security Advisories 82

Browse all 82 CVE security advisories affecting bplugins. AI-powered Chinese analysis, POCs, and references for each vulnerability.

bplugins operates as a software development firm specializing in WordPress plugins, primarily focusing on e-commerce solutions and digital product management. Its extensive portfolio has resulted in a significant security footprint, with seventy-two Common Vulnerabilities and Exposures (CVEs) currently documented. Historically, the most prevalent vulnerability classes affecting its products include Remote Code Execution (RCE), Cross-Site Scripting (XSS), and SQL Injection, often stemming from insufficient input validation and improper access controls. These flaws frequently allow unauthenticated attackers to execute arbitrary code or escalate privileges within compromised WordPress installations. While the company generally responds to disclosed issues, the high volume of historical incidents highlights systemic challenges in maintaining rigorous code review processes across its diverse plugin ecosystem. This pattern underscores the critical need for enhanced security testing in widely deployed third-party WordPress extensions to mitigate widespread exploitation risks.

Top products by bplugins: B Blocks bSlider – Create Responsive Image, Post, Product, and Video Sliders Tiktok Feed Button Block HTML5 Video Player – Embed and Play Videos in Custom Player Button Block – Design Stylish, Interactive, and Multi-Functional Buttons Html5 Audio Player HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player B Slider PDF Poster Info Cards Icon List Block Document Embedder – Embed PDFs, Word, Excel, and Other Files 3D viewer – Embed 3D Models Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) Info Cards – Add Text and Media in Card Layouts Panorama Viewer – 360 Degree Image + Video Viewer Services Section Block – Showcase Service Details in Grid or Columns Flash & HTML5 Video Advanced scrollbar Image Gallery block – Create and display photo gallery/photo album. Carousel Block – Responsive Image and Content Carousel MailChimp Block Voice Feedback YT Player Block for Mailchimp – Add Email Subscription Forms and Collect Leads Media Player Addons for Elementor – Audio and Video Widgets for Elementor Icons Font Loader – Load Web Fonts and Icon Libraries Survey Form Block – collect answers and insights from your audience Icon List Block – Add Icon-Based Lists with Custom Styles
CVE ID Title CVSS Severity Published
CVE-2026-5626 Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export — Survey Form Block – collect answers and insights from your audience CWE-862 4.3 Medium 2026-07-29
CVE-2026-27422 WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability — YT Player CWE-862 5.3 Medium 2026-07-23
CVE-2026-57647 WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability — Panorama Viewer – 360 Degree Image + Video Viewer CWE-98 7.5 High 2026-06-26
CVE-2026-57323 WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability — Flash & HTML5 Video CWE-862 5.8 Medium 2026-06-26
CVE-2026-56063 WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability — MailChimp Block CWE-862 8.3 High 2026-06-26
CVE-2026-11402 Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute — Services Section Block – Showcase Service Details in Grid or Columns CWE-79 6.4 Medium 2026-06-18
CVE-2026-39579 WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability — B Blocks CWE-266 8.8 High 2026-06-15
CVE-2026-53736 Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action — Easy Twitter Feeds CWE-352 4.3 Medium 2026-06-10
CVE-2026-24520 WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability — Tiktok Feed CWE-862 4.3 Medium 2026-05-26
CVE-2026-27416 WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability — PDF Poster CWE-862 5.3 Medium 2026-05-07
CVE-2026-6446 My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action — My Social Feeds – Social Feeds Embedder Plugin for WordPress CWE-522 5.4 Medium 2026-05-02
CVE-2026-40729 WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability — 3D viewer – Embed 3D Models CWE-862 4.3 Medium 2026-04-15
CVE-2026-32489 WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability — B Blocks CWE-862 6.5 Medium 2026-03-25
CVE-2026-4120 Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes — Info Cards – Add Text and Media in Card Layouts CWE-79 6.4 Medium 2026-03-19
CVE-2026-32416 WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability — PDF Poster CWE-862 5.4 Medium 2026-03-13
CVE-2026-32359 WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability — Icon List Block CWE-79 6.5 Medium 2026-03-13
CVE-2026-1228 Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute — Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) CWE-639 4.3 Medium 2026-02-06
CVE-2026-1294 All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint — All In One Image Viewer Block – Gutenberg block to create image viewer with hyperlink CWE-918 7.2 High 2026-02-05
CVE-2026-1389 Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion — Document Embedder – Embed PDFs, Word, Excel, and Other Files CWE-639 4.3 Medium 2026-01-28
CVE-2026-24565 WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability — B Accordion CWE-201 6.5 Medium 2026-01-23
CVE-2026-24383 WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability — B Slider CWE-79 6.5 Medium 2026-01-22
CVE-2026-0833 Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link — Team Section Block – Showcase Team Members with Layout Options CWE-79 6.4 Medium 2026-01-17
CVE-2025-13999 HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery — HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player CWE-918 7.2 High 2025-12-19
CVE-2025-60079 WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability — Parallax Section block CWE-862 7.1 High 2025-12-18
CVE-2025-66110 WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability — Tiktok Feed CWE-862 5.3 Medium 2025-11-21
CVE-2025-12376 Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery — Icon List Block – Add Icon-Based Lists with Custom Styles CWE-918 6.4 Medium 2025-11-18
CVE-2025-54711 WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability — Info Cards CWE-862 7.1 High 2025-11-06
CVE-2025-49900 WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability — Advanced scrollbar CWE-266 8.8 High 2025-11-06
CVE-2025-49394 WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability — Image Gallery block – Create and display photo gallery/photo album. CWE-862 7.1 High 2025-11-06
CVE-2025-12384 Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation — Document Embedder – Embed PDFs, Word, Excel, and Other Files CWE-862 8.6 High 2025-11-05

This page lists every published CVE security advisory associated with bplugins. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.