Threat database

CVE-2026-62037 is a high severity unauthenticated Cross-Site Scripting (XSS) vulnerability in bPlugins Document Embedder versions up to 2.4.0. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication. The vulnerability is identified as CWE-79 and has a CVSS v3.1 score of 7.1, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided by the vendor. Users should monitor vendor advisories for updates and apply fixes once available.

CVE-2026-62034 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in the Before After Image Comparison – Image comparison for WP plugin for WordPress. It affects versions up to and including 1.1.21. The vulnerability allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability.

CVE-2026-62030 is a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting bPlugins StreamCast versions up to and including 2.4.5. This vulnerability allows unauthenticated attackers to induce the server to make arbitrary requests, potentially leading to limited confidentiality and integrity impacts. No official patch or remediation details are provided in the available data.

CVE-2026-62027 is a high-severity vulnerability in the bPlugins Team Section Block plugin, versions up to and including 2.0.4. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability.

CVE-2026-62044 is a deserialization of untrusted data vulnerability in bPlugins Super Video Player up to version 1.8.13. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 7.2. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

CVE-2026-62028 is a missing authorization vulnerability in the bPlugins Before After Image Comparison plugin for WordPress, affecting versions up to and including 1.1.21. This flaw allows users with limited privileges to bypass access controls, potentially leading to unauthorized actions within the plugin. The vulnerability has a medium severity with a CVSS score of 5.4.

CVE-2026-62039 is a stored cross-site scripting (XSS) vulnerability in the bPlugins Html5 Audio Player plugin. It affects versions from 0 up to and including 2.8.8. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can be stored and later executed in users' browsers.

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

The Survey Form Block plugin for WordPress up to version 1.0.1 has a missing authorization vulnerability in the get_all_data() function. This flaw allows authenticated users with Subscriber-level access or higher to export all survey submission data and column metadata without proper permission checks. The vulnerability is identified as CWE-862 and has a CVSS score of 4.3, indicating medium severity.

Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.

Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists inside HTML comments in post_content, bypassing wp_kses_post sanitization at save time, and executes via both the primary service link anchor and a secondary title-wrapped anchor when the linkIn option is set to 'title'.

Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.

CVE-2026-24520 is a missing authorization vulnerability in the bPlugins Tiktok Feed plugin affecting versions up to 1.0.24. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity with a CVSS score of 4.3. There is no official patch or remediation level currently provided by the vendor, and no known exploits in the wild have been reported. The affected product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.