WordPress plugin
BulletProof Security security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High2
- Medium11
- Low0
All BulletProof Security vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Unauthenticated Information Exposure ≤7.2No patch available | CVE-2026-119273 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure ≤6.9Update to 7.0 | CVE-2025-67931 | |
| Medium6.1 | Stored Cross-Site Scripting <6.1Update to 6.1 | CVE-2022-1265 | |
| Medium5.5 | Admin+ Stored Cross-Site Scripting <5.8Update to 5.8 | CVE-2022-0590 | |
| Medium5.3 | Sensitive Information Disclosure ≤5.1Update to 5.2 | CVE-2021-39327 | |
| Medium6.4 | Authenticated Cross-Site Scripting <.53.4Update to .53.4 | — | |
| High7.2 | Cross-Site Scripting ≤.53.2Update to .53.3 | — | |
| Medium5.4 | Cross-Site Scripting <.51.1Update to .51.1 | CVE-2014-7958 | |
| Medium4.3 | Server-Side Request Forgery ≤.51Update to .51.1 | CVE-2014-8749 | |
| High8.8 | SQL Injection <.51.1Update to .51.1 | CVE-2014-7959 | |
| Medium4.8 | Cross-Site Scripting <.52.5Update to .52.5 | CVE-2015-9230 | |
| Medium6.1 | Cross-Site Scripting ≤.48.9Update to .49 | CVE-2013-3487 | |
| Medium6.1 | Reflected Cross-Site Scripting <.47.1Update to .47.1 | CVE-2012-4268 |
- Medium5.3Unauthenticated Information Exposure
≤7.2No patch available
- Medium5.3Unauthenticated Sensitive Information Exposure
≤6.9Update to 7.0
- Medium6.1Stored Cross-Site Scripting
<6.1Update to 6.1
- Medium5.5Admin+ Stored Cross-Site Scripting
<5.8Update to 5.8
- Medium5.3Sensitive Information Disclosure
≤5.1Update to 5.2
- Medium6.4Authenticated Cross-Site Scripting
<.53.4Update to .53.4
- High7.2Cross-Site Scripting
≤.53.2Update to .53.3
- Medium5.4Cross-Site Scripting
<.51.1Update to .51.1
- Medium4.3Server-Side Request Forgery
≤.51Update to .51.1
- High8.8SQL Injection
<.51.1Update to .51.1
- Medium4.8Cross-Site Scripting
<.52.5Update to .52.5
- Medium6.1Cross-Site Scripting
≤.48.9Update to .49
- Medium6.1Reflected Cross-Site Scripting
<.47.1Update to .47.1
BulletProof Security: common questions
Does BulletProof Security have known vulnerabilities?
Yes. VulnCrest Radar lists 13 known vulnerabilities in BulletProof Security: 2 high, 11 medium. At least one is not fixed in the latest version.
How do I check which version of BulletProof Security I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent BulletProof Security vulnerability?
CVE-2026-119273, published Nov 10, 2026: BulletProof Security <= 7.2 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).
Is any BulletProof Security vulnerability listed in CISA KEV?
No. None of the known BulletProof Security vulnerabilities is currently listed in the CISA KEV catalog.