plugin
2 known security issues reported for the Business Profile WordPress plugin. Most recent disclosed Jun 30, 2026.
Running Business Profile on your site? Check whether your installed version is affected.
Scan your site freeThe Five Star Business Profile and Schema plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.3.19. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.
The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation,...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free