bPlugins · weakness class
Access Control
32 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 32 is a mark on the map. Named now: 1 to 26, most at risk first.
- Document Embedder < 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure
- Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure
- B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation
- B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function
- Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure
- WordPress Animated Text Block plugin <= 1.0.7 - Broken Access Control vulnerability
- WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability
- HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler
- WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability
- B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode
- WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability
- Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export
- Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
- WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerability
- WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability
- HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
- WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability
- WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability
- WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability
- WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability
- WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability
- Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
- WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability
- WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability
- WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability
- WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.