Plugin security history

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 20 vulnerability records associated with Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC), published between 2018 and 2025.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

20Total records

2Critical

6High

12Medium

0Low

0Informational

18Patched records

2Currently marked unpatched

2018-11-09First disclosure

2025-10-19Latest disclosure

18 of 20CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	1	1 records
2019	1	1 records
2022	3	3 records
2023	3	3 records
2024	8	8 records
2025	4	4 records

Severity Breakdown

Severity	Records	Share
Critical	2	10%
High	6	30%
Medium	12	60%

Vulnerability-Type Breakdown

Cross-Site Scripting

8 records40%

First: 2022. Latest: 2025.

Missing Authorization

6 records30%

First: 2019. Latest: 2025.

Other

4 records20%

First: 2023. Latest: 2025.

SQL Injection

1 record5%

First: 2018. Latest: 2018.

Privilege Escalation

1 record5%

First: 2024. Latest: 2024.

Patch Status

Patched: 18
Currently marked unpatched: 2
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.8.16
2.8.14
2.8.13
2.8.12
2.8.10
2.8.9
2.8.6
2.8.8
2.8.3
2.8.2
2.7.8
2.7.3
2.6.10
2.6.3
2.3.2
2.2.8

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.9.0`	BuddyForms <= 2.9.0 - Missing Authorization	October 19, 2025	Not supplied	Medium
`*-2.8.17`	BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion	April 4, 2025	Not supplied	High
`*-2.8.15`	Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode	February 21, 2025	2.8.16	Medium
`*-2.8.13`	Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 30, 2025	2.8.14	Medium
`*-2.8.12`	BuddyForms <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting	September 30, 2024	2.8.13	Medium
`*-2.8.11`	Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation	September 13, 2024	2.8.12	High
`*-2.8.9`	BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness	June 4, 2024	2.8.10	Medium
`*-2.8.8`	BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery	April 22, 2024	2.8.9	Critical
`*-2.8.5`	BuddyForms <= 2.8.5 - Reflected Cross-Site Scripting via page	March 25, 2024	2.8.6	Medium
`*-2.8.7`	Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload	March 6, 2024	2.8.8	High
`*-2.8.7`	Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion	March 6, 2024	2.8.8	High
`*-2.8.7`	Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization	March 6, 2024	2.8.8	Medium
`*-2.8.2`	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	July 18, 2023	2.8.3	Medium
`*-2.8.1`	Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 11, 2023	2.8.2	Medium
`*-2.7.7`	BuddyForms <= 2.7.7 - PHAR Deserialization	February 20, 2023	2.7.8	High
`*-2.7.2`	BuddyForms <= 2.7.2 - Authenticated (Contributor+) Stored Stored Cross-Site Scripting	October 27, 2022	2.7.3	Medium
`*-2.6.9`	Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.6.9 - Cross-Site Scripting	June 26, 2022	2.6.10	Medium
`[*, 2.6.3)`	Freemius SDK <= 2.4.2 - Missing Authorization Checks	March 4, 2022	2.6.3	Medium
`[*, 2.3.2)`	Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update	February 25, 2019	2.3.2	High
`*-2.2.7`	Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.2.7 - SQL Injection	November 9, 2018	2.2.8	Critical

Selected source records

Latest Records

MediumCVE-2025-62973

BuddyForms <= 2.9.0 - Missing Authorization

Published: October 19, 2025

Affected versions: *-2.9.0
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-32151

BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion

Published: April 4, 2025

Affected versions: *-2.8.17
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-12038

Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode

Published: February 21, 2025

Affected versions: *-2.8.15
Patched versions: 2.8.16

Original Wordfence record

MediumCVE-2024-12037

Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 30, 2025

Affected versions: *-2.8.13
Patched versions: 2.8.14

Original Wordfence record

MediumCVE-2024-47377

BuddyForms <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting

Published: September 30, 2024

Affected versions: *-2.8.12
Patched versions: 2.8.13

Original Wordfence record

HighCVE-2024-8246

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

Published: September 13, 2024

Affected versions: *-2.8.11
Patched versions: 2.8.12

Original Wordfence record

MediumCVE-2024-5149

BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness

Published: June 4, 2024

Affected versions: *-2.8.9
Patched versions: 2.8.10

Original Wordfence record

CriticalCVE-2024-32830

BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery

Published: April 22, 2024

Affected versions: *-2.8.8
Patched versions: 2.8.9

Original Wordfence record

Highest-Severity Records

CriticalCVE-2018-21003

Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.2.7 - SQL Injection

Published: November 9, 2018

Affected versions: *-2.2.7
Patched versions: 2.2.8

Original Wordfence record

CriticalCVE-2024-32830

BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery

Published: April 22, 2024

Affected versions: *-2.8.8
Patched versions: 2.8.9

Original Wordfence record

HighCVE-2023-26326

BuddyForms <= 2.7.7 - PHAR Deserialization

Published: February 20, 2023

Affected versions: *-2.7.7
Patched versions: 2.7.8

Original Wordfence record

High

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update

Published: February 25, 2019

Affected versions: [*, 1.9.3)
Patched versions: 1.9.3

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-0.1.9
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: [*, 1.1.4)
Patched versions: 1.1.4

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: [*, 1.6.5)
Patched versions: 1.6.5

Affected versions: *-1.0.3
Patched versions: Not supplied

Affected versions: *-0.3
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.2.3
Patched versions: Not supplied

Affected versions: *-1.3.2
Patched versions: Not supplied

Affected versions: *-1.0.17
Patched versions: Not supplied

Affected versions: [*, 1.8.3)
Patched versions: 1.8.3

Affected versions: [*, 2.6)
Patched versions: 2.6

Affected versions: *-2.1
Patched versions: Not supplied

Affected versions: [*, 1.2.9)
Patched versions: 1.2.9

Affected versions: [*, 1.2.6)
Patched versions: 1.2.6

Affected versions: *-1.1.7
Patched versions: Not supplied

Affected versions: [*, 2.18.0)
Patched versions: 2.18.0

Affected versions: [*, 1.3.1)
Patched versions: 1.3.1

Affected versions: *-1.1.6
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: [*, 2.3.2)
Patched versions: 2.3.2

Affected versions: *-3.1
Patched versions: Not supplied

Affected versions: [*, 1.1.3)
Patched versions: 1.1.3

Affected versions: [*, 2.0.1)
Patched versions: 2.0.1

Affected versions: [*, 1.6.3)
Patched versions: 1.6.3

Affected versions: *-0.4.0
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.0.4
Patched versions: Not supplied

Affected versions: *-1.1.0
Patched versions: Not supplied

Affected versions: [*, 0.7.3)
Patched versions: 0.7.3

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.2.0
Patched versions: Not supplied

Affected versions: [*, 1.4.0)
Patched versions: 1.4.0

Affected versions: *-1.1.1
Patched versions: Not supplied

Affected versions: [*, 1.6.17)
Patched versions: 1.6.17

Affected versions: [*, 1.3.20)
Patched versions: 1.3.20

Affected versions: [*, 3.0.4)
Patched versions: 3.0.4

Affected versions: *-1.1.2
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: [*, 1.0.2)
Patched versions: 1.0.2

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.0.6
Patched versions: Not supplied

Affected versions: *-1.1.2
Patched versions: Not supplied

Affected versions: *-2.1
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.9.4
Patched versions: Not supplied

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: *-2.0.0
Patched versions: Not supplied

Affected versions: *-1.7.2
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-1.5.5
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-0.0.19
Patched versions: Not supplied

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: *-1.0.5
Patched versions: Not supplied

Affected versions: [*, 3.8.1)
Patched versions: 3.8.1

Affected versions: *-1.0.7
Patched versions: Not supplied

Affected versions: *-1.0.3
Patched versions: Not supplied

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: [*, 3.2.6.1)
Patched versions: 3.2.6.1

Affected versions: *-1.0.41
Patched versions: Not supplied

Affected versions: [*, 2.1.9.8)
Patched versions: 2.1.9.8

Affected versions: *-1.5.9.4
Patched versions: Not supplied

Affected versions: [*, 4.2997)
Patched versions: 4.2997

Affected versions: *-1.1.0
Patched versions: Not supplied

Affected versions: [*, 3.3.1.2)
Patched versions: 3.3.1.2

Affected versions: *-5.0
Patched versions: Not supplied

Affected versions: [*, 1.4.3)
Patched versions: 1.4.3

Affected versions: *-2.0
Patched versions: Not supplied

Affected versions: *-2.0.0
Patched versions: Not supplied

Affected versions: *-1.9.1
Patched versions: Not supplied

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: *-3.1
Patched versions: 3.2

Affected versions: *-2.4.7
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-1.0.5
Patched versions: Not supplied

Affected versions: [*, 2.7.3)
Patched versions: 2.7.3

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-201704251008
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-2.0
Patched versions: Not supplied

Affected versions: [*, 1.7.2)
Patched versions: 1.7.2

Affected versions: [*, 3.0.2)
Patched versions: 3.0.2

Affected versions: *-1.0.3
Patched versions: Not supplied

Affected versions: *-1.1.1
Patched versions: Not supplied

Affected versions: [*, 4.1.9.5)
Patched versions: 4.1.9.5

Affected versions: [*, 3.0.6)
Patched versions: 3.0.6

Affected versions: [*, 0.7.2)
Patched versions: 0.7.2

Affected versions: [*, 2.5.2)
Patched versions: 2.5.2

Affected versions: *-1.5.2
Patched versions: Not supplied

Affected versions: [*, 4.0.5)
Patched versions: 4.0.5

Affected versions: [*, 3.3.57)
Patched versions: 3.3.57

Affected versions: [*, 2.6.4)
Patched versions: 2.6.4

Affected versions: [*, 3.0.9)
Patched versions: 3.0.9

Affected versions: *-201703020805
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-0.0.17
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-1.0.4
Patched versions: Not supplied

Affected versions: *-1.4.0
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-2.0
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: [*, 3.3.0)
Patched versions: 3.3.0

Affected versions: [*, 2.2.3.1)
Patched versions: 2.2.3.1

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.9.21
Patched versions: 1.0.9.22

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: [*, 1.0.4)
Patched versions: 1.0.4

Affected versions: [*, 0.1.1)
Patched versions: 0.1.1

Affected versions: [*, 1.1.4)
Patched versions: 1.1.4

Affected versions: [*, 3.1.7)
Patched versions: 3.1.7

Affected versions: *-1.6.1
Patched versions: Not supplied

Affected versions: [*, 1.0.1)
Patched versions: 1.0.1

Affected versions: [*, 3.2)
Patched versions: 3.2

Affected versions: [*, 0.7.1)
Patched versions: 0.7.1

Affected versions: *-1.0.1
Patched versions: Not supplied

Original Wordfence record

HighCVE-2024-8246

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

Published: September 13, 2024

Affected versions: *-2.8.11
Patched versions: 2.8.12

Original Wordfence record

HighCVE-2025-32151

BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion

Published: April 4, 2025

Affected versions: *-2.8.17
Patched versions: Not supplied

Original Wordfence record

HighCVE-2024-1170

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion

Published: March 6, 2024

Affected versions: *-2.8.7
Patched versions: 2.8.8

Original Wordfence record

HighCVE-2024-1169

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload

Published: March 6, 2024

Affected versions: *-2.8.7
Patched versions: 2.8.8

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-62973

BuddyForms <= 2.9.0 - Missing Authorization

Published: October 19, 2025

Affected versions: *-2.9.0
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-32151

BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion

Published: April 4, 2025

Affected versions: *-2.8.17
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory