plugin

Vibebp Vulnerabilities

6 known security issues reported for the Vibebp WordPress plugin. Most recent disclosed Dec 31, 2024.

1 critical 1 high 1 medium

Running Vibebp on your site? Check whether your installed version is affected.

Scan your site free

Vibe BP [vibebp] < 1.9.9.5.1

unknown

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP allows SQL Injection.This issue affects VibeBP: from n/a before 1.9.9.5.1.

Affected:
up to 1.9.9.5.1
Fixed in:
1.9.9.5.1
Disclosed:
Dec 31, 2024

CVE-2024-56041 on NVD →

Vibe BP [vibebp] < 1.9.9.7.7

unknown

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP allows SQL Injection.This issue affects VibeBP: from n/a before 1.9.9.7.7.

Affected:
up to 1.9.9.7.7
Fixed in:
1.9.9.7.7
Disclosed:
Dec 31, 2024

CVE-2024-56039 on NVD →

Vibe BP [vibebp] < 1.9.9.5

unknown

[en] Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP allows Privilege Escalation.This issue affects VibeBP: from n/a through 1.9.9.4.1.

Affected:
up to 1.9.9.5
Fixed in:
1.9.9.5
Disclosed:
Dec 31, 2024

CVE-2024-56040 on NVD →

VibeBP <= 1.9.9.4.1 - Unauthenticated Privilege Escalation

critical

The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.4.1. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

CVSS:
9.8
Affected:
up to 1.9.9.4.1
Fixed in:
1.9.9.5
Disclosed:
Dec 17, 2024

CVE-2024-56040 on NVD →

VibeBP < 1.9.9.7.7 - Unauthenticated SQL Injection

high

The VibeBP plugin for WordPress is vulnerable to SQL Injection in versions up to 1.9.9.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin...

CVSS:
7.5
Affected:
up to 1.9.9.7.7
Fixed in:
1.9.9.7.7
Disclosed:
Dec 17, 2024

CVE-2024-56039 on NVD →

VibeBP < 1.9.9.5.1 - Authenticated (Subscriber+) SQL Injection

medium

The VibeBP plugin for WordPress is vulnerable to SQL Injection in versions up to 1.9.9.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append addi...

CVSS:
6.5
Affected:
up to 1.9.9.5.1
Fixed in:
1.9.9.5.1
Disclosed:
Dec 17, 2024

CVE-2024-56041 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database