Bplugins
Vulnerability activity for Bplugins: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.4MediumOct 28, 2026Bplugins Document Embedder – let visitors read files without downloading XSSCVE-2026-109370The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
- 7.5HighOct 28, 2026Bplugins Animated Text Block – Add Typing and Looping Text Effects Auth bypass / access controlCVE-2026-116613The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch, calling displayContent() with no capability check and no validation that the post's post_type is the plugin's own CPT or is otherwise viewable (is_post_type_viewable()). This makes it possible for au
- 6.5MediumOct 26, 2026bPlugins Panorama Viewer – 360 Degree Image + Video Viewer XSSCVE-2026-115956Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3.
- 6.5MediumOct 26, 2026bPlugins Advanced Post Block - Post Grid for WordPress block editor XSSCVE-2026-115955Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid for WordPress block editor: from n/a through 2.5.1.
- 6.5MediumOct 26, 2026bPlugins Image Gallery block – Create and display photo gallery/photo album. XSSCVE-2026-115613Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1.
- 7.5HighJun 26, 2026bPlugins Panorama Viewer – 360 Degree Image + Video Viewer Path traversal / file handlingCVE-2026-57647Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.
- 8.3HighJun 26, 2026bPlugins MailChimp Block Auth bypass / access controlCVE-2026-56063Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
Top products
- Panorama Viewer – 360 Degree Image + Video Viewer2 CVEs in the last year
- MailChimp Block1 CVE in the last year
- Image Gallery block – Create and display photo gallery/photo album.1 CVE in the last year
- Document Embedder – let visitors read files without downloading1 CVE in the last year
- Animated Text Block – Add Typing and Looping Text Effects1 CVE in the last year
- Advanced Post Block - Post Grid for WordPress block editor1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.