Log in Start free

ThemeKraft

Products

ProductCVEsExploitedLatest
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)7–Feb 22, 2025
BuddyForms6–Sep 10, 2026
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages3–Mar 1, 2025
WooBuddy2–Jun 10, 2024
Post Form1–Aug 25, 2023
Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions1–Mar 16, 2023
TK Google Fonts GDPR Compliant1–Nov 6, 2023
All in One Invite Codes1–Oct 16, 2024

Exploited and recent CVEs

  • CVE-2026-81785 Medium 6.5 WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability 0.3%
  • CVE-2025-62973 Medium 5.3 WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability 0.2%
  • CVE-2025-32151 High 7.5 WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability 1.0%
  • CVE-2025-1780 Medium 4.3 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update 0.3%
  • CVE-2024-13358 Medium 4.3 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update 0.3%
  • CVE-2024-12038 Medium 6.4 Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode 0.2%
  • CVE-2024-12037 Medium 6.4 Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2022-4974 Medium 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks 0.4%
  • CVE-2024-47377 Medium 5.9 WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-8246 High 8.8 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation 0.4%
  • CVE-2024-35726 Medium 4.3 WordPress WooBuddy plugin <= 3.4.19 - Broken Access Control vulnerability 0.4%
  • CVE-2024-5149 Medium 6.5 BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness 0.4%
  • CVE-2024-32830 High 8.6 WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability 0.6%
  • CVE-2024-32603 High 8.5 WordPress WooBuddy plugin <= 3.4.20 - PHP Object Injection vulnerability 0.5%
  • CVE-2024-30198 Medium 5.8 WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-2025 High 8.8 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request 0.8%
  • CVE-2024-1158 Medium 4.3 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization 0.5%
  • CVE-2024-1169 High 7.5 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload 0.6%
  • CVE-2024-1170 High 8.2 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion 0.7%
  • CVE-2023-5823 Medium 4.3 WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
  • CVE-2023-25981 Medium 6.5 WordPress BuddyForms Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS) 0.4%
  • CVE-2022-38971 Medium 4.7 WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS) 0.4%