# BuddyForms

> BuddyForms is a versatile plugin that allows the creation of post forms, registration forms, profile forms, content forms, and supports file uploads.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:30 UTC.

## Facts (WordPress.org)

- Slug: `buddyforms`
- Author: Themekraft
- Version: 2.10.7
- Active installs: 800+
- Last update: 2026-11-12 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.9, PHP 7.4
- Tags: custom form, form builder, forms, registration, User Registration
- Page: https://wordpress.org/plugins/buddyforms/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Locked in ↔ Portable, Paywalled ↔ Generous, Breaking ↔ Smooth.

## Known vulnerabilities

- 2026-11-05 CRITICAL: Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter (up to 2.10.5). CVE-2026-107622, https://www.wordfence.com/threat-intel/vulnerabilities/id/2e83e654-f8a6-44a6-a687-92606331309e?source=api-prod
- 2026-11-05 MEDIUM: Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion (up to 2.10.5). CVE-2026-107658, https://www.wordfence.com/threat-intel/vulnerabilities/id/ec36eff4-0f85-4d89-b209-aaf07ae2ff9c?source=api-prod
- 2026-10-31 MEDIUM: Unauthenticated Arbitrary Guest Attachment Deletion (2.8.8 to 2.10.0). CVE-2026-118437, https://www.wordfence.com/threat-intel/vulnerabilities/id/10ff714f-b720-473e-8308-359829f19700?source=api-prod
- 2026-10-30 MEDIUM: Unauthenticated Information Exposure (up to 2.10.2). CVE-2026-118100, https://www.wordfence.com/threat-intel/vulnerabilities/id/453f6a60-1acd-4c24-a252-91c7b74ad631?source=api-prod
- 2026-10-30 MEDIUM: Missing Authorization (up to 2.10.0). CVE-2026-118101, https://www.wordfence.com/threat-intel/vulnerabilities/id/c309a873-5dae-4727-b4ee-05a45108233c?source=api-prod
- 2026-09-10 MEDIUM: Missing Authorization (up to 2.9.0). CVE-2026-81785, https://www.wordfence.com/threat-intel/vulnerabilities/id/02487c67-9073-47ea-bf72-e33cc4184c7c?source=api-prod
- 2025-10-19 MEDIUM: Missing Authorization (up to 2.9.0). CVE-2025-62973, https://www.wordfence.com/threat-intel/vulnerabilities/id/c84cf8f1-ff13-47e9-bf9d-a6f638af0492?source=api-prod
- 2025-04-04 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 2.8.17). CVE-2025-32151, https://www.wordfence.com/threat-intel/vulnerabilities/id/51cd2cb8-ac77-4962-9156-da0195ce1003?source=api-prod
- 2025-02-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode (up to 2.8.15). CVE-2024-12038, https://www.wordfence.com/threat-intel/vulnerabilities/id/ff0568e2-3a1e-4ed6-835a-37e3d07d7b63?source=api-prod
- 2025-01-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.8.13). CVE-2024-12037, https://www.wordfence.com/threat-intel/vulnerabilities/id/accd4f34-4e10-4c83-96c3-c2a078ecd5cc?source=api-prod
- 2024-09-30 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting (up to 2.8.12). CVE-2024-47377, https://www.wordfence.com/threat-intel/vulnerabilities/id/ac8a06f5-4560-401c-b762-5422b624ba84?source=api-prod
- 2024-09-13 HIGH: Authenticated (Contributor+) Privilege Escalation (up to 2.8.11). CVE-2024-8246, https://www.wordfence.com/threat-intel/vulnerabilities/id/40760f60-b81a-447b-a2c8-83c7666ce410?source=api-prod
- 2024-06-04 MEDIUM: Email Verification Bypass due to Insufficient Randomness (up to 2.8.9). CVE-2024-5149, https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=api-prod
- 2024-04-22 CRITICAL: Unauthenticated Arbitrary File Read and Server-Side Request Forgery (up to 2.8.8). CVE-2024-32830, https://www.wordfence.com/threat-intel/vulnerabilities/id/23d762e9-d43f-4520-a6f1-c920417a2436?source=api-prod
- 2024-03-25 MEDIUM: Reflected Cross-Site Scripting via page (up to 2.8.5). CVE-2024-30198, https://www.wordfence.com/threat-intel/vulnerabilities/id/701d6bee-6eb2-4497-bf54-fbc384d9d2e5?source=api-prod
- 2024-03-06 MEDIUM: Missing Authorization (up to 2.8.7). CVE-2024-1158, https://www.wordfence.com/threat-intel/vulnerabilities/id/198cb3bb-73fe-45ae-b8e0-b7ee8dda9547?source=api-prod
- 2024-03-06 HIGH: Missing Authorization to Unauthenticated Media Deletion (up to 2.8.7). CVE-2024-1170, https://www.wordfence.com/threat-intel/vulnerabilities/id/380c646c-fd95-408a-89eb-3e646768bbc5?source=api-prod
- 2024-03-06 HIGH: Missing Authorization to Unauthenticated Media Upload (up to 2.8.7). CVE-2024-1169, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d14a90d-65ea-45da-956b-0735e2e2b538?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (up to 2.8.2). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e-232, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2023-05-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 2.8.1). CVE-2023-25981, https://www.wordfence.com/threat-intel/vulnerabilities/id/20793de1-468f-4b9d-8e1f-b05dc204c0fb?source=api-prod
- 2023-02-20 HIGH: PHAR Deserialization (up to 2.7.7). CVE-2023-26326, https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6669aa-e53c-45bb-88c4-2e1350993423?source=api-prod
- 2022-10-27 MEDIUM: Authenticated (Contributor+) Stored Stored Cross-Site Scripting (up to 2.7.2). CVE-2022-38971, https://www.wordfence.com/threat-intel/vulnerabilities/id/3c32eb5b-dc4b-42f6-8454-d2ad57d7051d?source=api-prod
- 2022-06-26 MEDIUM: Cross-Site Scripting (up to 2.6.9). WF-ba5d1bd4-da0d-43f4-b28f-4a4a2702b3b0, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5d1bd4-da0d-43f4-b28f-4a4a2702b3b0?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 2.6.3). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42-137, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod
- 2019-02-25 HIGH: Missing Authorization to Arbitrary Options Update (before 2.3.2). WF-3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0-28, https://www.wordfence.com/threat-intel/vulnerabilities/id/3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0?source=api-prod
- 2018-11-09 CRITICAL: SQL Injection (up to 2.2.7). CVE-2018-21003, https://www.wordfence.com/threat-intel/vulnerabilities/id/599c6984-5d52-4d0f-86a1-b88f6c9797ed?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=buddyforms · HTML: https://todaywp.com/plugins/buddyforms