CVE-2026-107658
MediumCVSS 5.4Summary
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customize_changeset to place a malicious Custom HTML widget into the site's front end.
Risk Assessment
An unauthenticated attacker can inject malicious JavaScript that executes in the browsers of users visiting the site, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the BuddyForms plugin to a version later than 2.10.5 that fixes the vulnerability. Additionally, consider disabling public submissions if not needed and review custom HTML widgets.
Other vulnerabilities in BuddyForms
See all- CVE-2026-81785Medium
The BuddyForms plugin in versions up to and including 2.9.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control allows operations that a user should not be permitted to perform.
- CVE-2026-107622Critical
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. Unauthenticated attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges. Exploitation requires "Anyone can register" enabled and at least one public BuddyForms form attached to a page.
- CVE-2026-118437Low
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments. This allows unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
- CVE-2026-118101Medium
The BuddyForms plugin for WordPress before 2.10.1 does not verify that a user editing an existing entry is the author of the target post. This allows users with edit access to a form, as low as Subscriber, to overwrite the title, content, and status of any other user's posts or pages, including those of administrators.
- CVE-2026-118100Medium
The BuddyForms plugin for WordPress before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration. This allows unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys.
- CVE-2025-62973Medium
BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.
- CVE-2025-32151High
The BuddyForms plugin (up to version 2.10.2) contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement.
Original NVD description (English source)
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customize_changeset to place a malicious Custom HTML widget into the site's front end.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS