# bPlugins vulnerabilities Source: https://junglewise.ai/threats/vendors/bplugins Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/bplugins.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in bPlugins: 2 in the last 7 days and 21 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125451, was published on 11 November 2026. 14 vulnerabilities in the last four weeks, up 133% on the four before (6). 1 technology has a page of its own. ## Counts - Last 7 days: 2 - Last 30 days: 15 - Last 90 days: 21 - All time: 31 (0 critical, 0 exploited in the wild) ## About bPlugins A developer of plugins and extensions for the WordPress content management system. ## Latest bPlugins vulnerabilities - [CVE-2026-125451: bPlugins B Blocks stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125451-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-119500: bPlugins Flash & HTML5 Video stored cross-site scripting](https://junglewise.ai/threats/cve-2026-119500-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 7 Nov 2026) - [CVE-2026-119365: bPlugins Media Player Addons for Elementor stored XSS](https://junglewise.ai/threats/cve-2026-119365-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-118097: bPlugins Flash & HTML5 Video stored cross-site scripting](https://junglewise.ai/threats/cve-2026-118097-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-116849: bPlugins StreamCast stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116849-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-48195: bPlugins PDF Poster stored cross-site scripting](https://junglewise.ai/threats/cve-2026-48195-improper-neutralization-of-input-during-web-page-generation-cross) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-52709: bPlugins Video Gallery Block stored cross-site scripting](https://junglewise.ai/threats/cve-2026-52709-improper-neutralization-of-input-during-web-page-generation-cross) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-116400: bPlugins Button Block stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116400-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-116398: bPlugins Content Slider Block stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116398-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115966: bPlugins Typing Text stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115966-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-116395: bPlugins LightBox Block stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116395-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115961: bPlugins B Slider stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115961-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115956: bPlugins Panorama Viewer stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115956-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115955: bPlugins Advanced Post Block stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115955-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115613: bPlugins Image Gallery block stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115613-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-62027: Team Section Block cross-site scripting](https://junglewise.ai/threats/cve-2026-62027-unauthenticated-cross-site-scripting-xss-in-team-section-block-2) (high, CVSS 7.1, published 10 Oct 2026) - [CVE-2026-62044: bPlugins Super Video Player PHP object injection](https://junglewise.ai/threats/cve-2026-62044-deserialization-of-untrusted-data-vulnerability-in-bplugins-super) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-62028: bPlugins Before After Image Comparison broken access control](https://junglewise.ai/threats/cve-2026-62028-missing-authorization-vulnerability-in-bplugins-before-after) (medium, CVSS 5.4, published 9 Oct 2026) - [CVE-2026-62039: bPlugins Html5 Audio Player stored cross-site scripting](https://junglewise.ai/threats/cve-2026-62039-improper-neutralization-of-input-during-web-page-generation-cross) (medium, CVSS 6.5, published 9 Oct 2026) - [CVE-2026-104400: bPlugins B Blocks stored cross-site scripting](https://junglewise.ai/threats/cve-2026-104400-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-102378: Parallax Section block unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-102378-unauthenticated-cross-site-scripting-xss-in-parallax-section) (high, CVSS 7.1, published 1 Oct 2026) - [CVE-2026-5626: bPlugins Survey Form Block missing authorization in get_all_data](https://junglewise.ai/threats/cve-2026-5626-bplugins-survey-form-block-missing-authorization-in-get-all-data) (medium, CVSS 4.3, published 29 Jul 2026) - [CVE-2026-27422: bPlugins YT Player broken access control](https://junglewise.ai/threats/cve-2026-27422-bplugins-yt-player-broken-access-control) (medium, CVSS 5.3, published 23 Jul 2026) - [CVE-2026-57647: bPlugins Panorama Viewer Local File Inclusion](https://junglewise.ai/threats/cve-2026-57647-bplugins-panorama-viewer-local-file-inclusion) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-57323: bPlugins Flash & HTML5 Video broken access control](https://junglewise.ai/threats/cve-2026-57323-bplugins-flash-html5-video-broken-access-control) (medium, CVSS 5.8, published 26 Jun 2026) ## Most severe bPlugins vulnerabilities - [CVE-2026-39579: bPlugins B Blocks privilege escalation in WordPress plugin](https://junglewise.ai/threats/cve-2026-39579-bplugins-b-blocks-privilege-escalation-in-wordpress-plugin) (high, CVSS 8.8, published 15 Jun 2026) - [CVE-2026-56063: bPlugins MailChimp Block broken access control](https://junglewise.ai/threats/cve-2026-56063-bplugins-mailchimp-block-broken-access-control) (high, CVSS 8.3, published 26 Jun 2026) - [CVE-2026-57647: bPlugins Panorama Viewer Local File Inclusion](https://junglewise.ai/threats/cve-2026-57647-bplugins-panorama-viewer-local-file-inclusion) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-62044: bPlugins Super Video Player PHP object injection](https://junglewise.ai/threats/cve-2026-62044-deserialization-of-untrusted-data-vulnerability-in-bplugins-super) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-62027: Team Section Block cross-site scripting](https://junglewise.ai/threats/cve-2026-62027-unauthenticated-cross-site-scripting-xss-in-team-section-block-2) (high, CVSS 7.1, published 10 Oct 2026) - [CVE-2026-102378: Parallax Section block unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-102378-unauthenticated-cross-site-scripting-xss-in-parallax-section) (high, CVSS 7.1, published 1 Oct 2026) - [CVE-2026-104400: bPlugins B Blocks stored cross-site scripting](https://junglewise.ai/threats/cve-2026-104400-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-62039: bPlugins Html5 Audio Player stored cross-site scripting](https://junglewise.ai/threats/cve-2026-62039-improper-neutralization-of-input-during-web-page-generation-cross) (medium, CVSS 6.5, published 9 Oct 2026) - [CVE-2026-125451: bPlugins B Blocks stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125451-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-119500: bPlugins Flash & HTML5 Video stored cross-site scripting](https://junglewise.ai/threats/cve-2026-119500-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 7 Nov 2026) ## Vulnerabilities per week 14 vulnerabilities in the last four weeks, up 133% on the four before (6). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 5 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 13 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## bPlugins technologies - [bPlugins B Blocks](https://junglewise.ai/threats/technologies/b-blocks): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "bPlugins vulnerabilities", https://junglewise.ai/threats/vendors/bplugins, 12 November 2026.