Is BuddyForms safe?

Every recorded flaw

• Sep 10, 2026Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.CVE-2026-81785 · affects up to 2.9.0 · reported by PatchstackMedium 6.5
• Oct 26, 2025BuddyForms: Missing AuthorizationCVE-2025-62973 · affects up to 2.10.2 · reported by PatchstackMedium 5.3
• Apr 4, 2025BuddyForms: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32151 · affects up to 2.10.2 · reported by PatchstackHigh 7.5
• Feb 22, 2025Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Stored Cross-Site ScriptingCVE-2024-12038 · affects up to 2.8.15 · reported by WordfenceMedium 6.4
• Jan 31, 2025Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Stored Cross-Site ScriptingCVE-2024-12037 · affects up to 2.8.13 · reported by WordfenceMedium 6.4
• Oct 5, 2024BuddyForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47377 · affects up to 2.8.12 · reported by PatchstackMedium 5.9
• Sep 14, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Privilege escalationCVE-2024-8246 · affects up to 2.8.11 · reported by WordfenceHigh 8.8
• Jun 5, 2024BuddyForms: Email Verification BypassCVE-2024-5149 · affects up to 2.8.9 · reported by WordfenceMedium 6.5
• May 17, 2024BuddyForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-32830 · affects up to 2.8.8 · reported by PatchstackHigh 8.6
• Mar 27, 2024BuddyForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30198 · affects up to 2.8.5 · reported by PatchstackMedium 5.8
• Mar 13, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Unauthorized modification of dataCVE-2024-1158 · affects up to 2.8.7 · reported by WordfenceMedium 4.3
• Mar 7, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Unauthorized media file deletionCVE-2024-1170 · affects up to 2.8.7 · reported by WordfenceHigh 8.2
• Mar 7, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Unauthorized media uploadCVE-2024-1169 · affects up to 2.8.7 · reported by WordfenceHigh 7.5
• Aug 25, 2023Auth.CVE-2023-25981 · affects up to 2.8.1 · reported by PatchstackMedium 6.5
• Mar 16, 2023Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User SubmissiCVE-2022-38971 · affects up to 2.7.5 · reported by PatchstackMedium 4.7
• Aug 27, 2019The buddyforms plugin before 2.2.8 for WordPress has SQL injection.CVE-2018-21003 · fixed in 2.2.8 · reported by MITRE1.8% oddsCritical 9.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.