Known vulnerabilities in BulletProof Security

WordPress Security Protection: Malware scanner, Firewall, Login Security, DB Backup, Anti-Spam...

12Reported vulnerabilities

7.2Highest CVSS score

7.2Latest version

20,000+Active installs

What to do now

Update BulletProof Security to 7.0 or later. 12 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 20, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2021-39327	Medium 5.3	71.7%	5.1 and earlier	`5.2`	September 17, 2021
CVE-2014-7959	Medium 6.5	2.1%	.44 to .44 (inclusive) .44.1 to .44.1 (inclusive) .45 to .45 (inclusive) .45.1 to .45.1 (inclusive) .45.2 to .45.2 (inclusive) .45.3 to .45.3 (inclusive) .45.4 to .45.4 (inclusive) .45.5 to .45.5 (inclusive) .45.6 to .45.6 (inclusive) .45.7 to .45.7 (inclusive) .45.8 to .45.8 (inclusive) .45.9 to .45.9 (inclusive) .46 to .46 (inclusive) .46.1 to .46.1 (inclusive) .46.2 to .46.2 (inclusive) .46.3 to .46.3 (inclusive) .46.4 to .46.4 (inclusive) .46.5 to .46.5 (inclusive) .46.6 to .46.6 (inclusive) .46.7 to .46.7 (inclusive) .46.8 to .46.8 (inclusive) .46.9 to .46.9 (inclusive) .47 to .47 (inclusive) .47.1 to .47.1 (inclusive) .47.2 to .47.2 (inclusive) .47.3 to .47.3 (inclusive) .47.4 to .47.4 (inclusive) .47.5 to .47.5 (inclusive) .47.6 to .47.6 (inclusive) .47.7 to .47.7 (inclusive) .47.8 to .47.8 (inclusive) .47.9 to .47.9 (inclusive) .48 to .48 (inclusive) .48.1 to .48.1 (inclusive) .48.2 to .48.2 (inclusive) .48.3 to .48.3 (inclusive) .48.4 to .48.4 (inclusive) .48.5 to .48.5 (inclusive) .48.6 to .48.6 (inclusive) .48.7 to .48.7 (inclusive) .48.8 to .48.8 (inclusive) .48.9 to .48.9 (inclusive) .49 to .49 (inclusive) .49.1 to .49.1 (inclusive) .49.2 to .49.2 (inclusive) .49.3 to .49.3 (inclusive) .49.4 to .49.4 (inclusive) .49.5 to .49.5 (inclusive) .49.6 to .49.6 (inclusive) .49.7 to .49.7 (inclusive) .49.8 to .49.8 (inclusive) .49.9 to .49.9 (inclusive) .50 to .50 (inclusive) .50.1 to .50.1 (inclusive) .50.2 to .50.2 (inclusive) .50.3 to .50.3 (inclusive) .50.4 to .50.4 (inclusive) .50.5 to .50.5 (inclusive) .50.6 to .50.6 (inclusive) .50.7 to .50.7 (inclusive) .50.8 to .50.8 (inclusive) .50.9 to .50.9 (inclusive) .51 to .51 (inclusive)	`.51.1`	November 6, 2014
CVE-2015-9230	Medium 4.8	1.6%	.52.4 to .52.4 (inclusive)	`.52.5`	September 12, 2017
CVE-2014-7958	Medium 4.3	2.5%	.44 to .44 (inclusive) .44.1 to .44.1 (inclusive) .45 to .45 (inclusive) .45.1 to .45.1 (inclusive) .45.2 to .45.2 (inclusive) .45.3 to .45.3 (inclusive) .45.4 to .45.4 (inclusive) .45.5 to .45.5 (inclusive) .45.6 to .45.6 (inclusive) .45.7 to .45.7 (inclusive) .45.8 to .45.8 (inclusive) .45.9 to .45.9 (inclusive) .46 to .46 (inclusive) .46.1 to .46.1 (inclusive) .46.2 to .46.2 (inclusive) .46.3 to .46.3 (inclusive) .46.4 to .46.4 (inclusive) .46.5 to .46.5 (inclusive) .46.6 to .46.6 (inclusive) .46.7 to .46.7 (inclusive) .46.8 to .46.8 (inclusive) .46.9 to .46.9 (inclusive) .47 to .47 (inclusive) .47.1 to .47.1 (inclusive) .47.2 to .47.2 (inclusive) .47.3 to .47.3 (inclusive) .47.4 to .47.4 (inclusive) .47.5 to .47.5 (inclusive) .47.6 to .47.6 (inclusive) .47.7 to .47.7 (inclusive) .47.8 to .47.8 (inclusive) .47.9 to .47.9 (inclusive) .48 to .48 (inclusive) .48.1 to .48.1 (inclusive) .48.2 to .48.2 (inclusive) .48.3 to .48.3 (inclusive) .48.4 to .48.4 (inclusive) .48.5 to .48.5 (inclusive) .48.6 to .48.6 (inclusive) .48.7 to .48.7 (inclusive) .48.8 to .48.8 (inclusive) .48.9 to .48.9 (inclusive) .49 to .49 (inclusive) .49.1 to .49.1 (inclusive) .49.2 to .49.2 (inclusive) .49.3 to .49.3 (inclusive) .49.4 to .49.4 (inclusive) .49.5 to .49.5 (inclusive) .49.6 to .49.6 (inclusive) .49.7 to .49.7 (inclusive) .49.8 to .49.8 (inclusive) .49.9 to .49.9 (inclusive) .50 to .50 (inclusive) .50.1 to .50.1 (inclusive) .50.2 to .50.2 (inclusive) .50.3 to .50.3 (inclusive) .50.4 to .50.4 (inclusive) .50.5 to .50.5 (inclusive) .50.6 to .50.6 (inclusive) .50.7 to .50.7 (inclusive) .50.8 to .50.8 (inclusive) .50.9 to .50.9 (inclusive) .51 to .51 (inclusive)	`.51.1`	November 6, 2014
CVE-2022-1265	Medium 4.8	0.6%	Before 6.1	`6.1`	May 16, 2022
CVE-2022-0590	Medium 4.8	0.6%	Before 5.8	`5.8`	March 21, 2022
WF-eab98c41-f0f2-4953-b9b3-c08e1e92c03a	High 7.2	—	.53.2 and earlier	`.53.3`	March 17, 2016
CVE-2012-4268	Medium 6.1	2.0%	Before .47.1	`.47.1`	May 11, 2012
WF-f232f550-f964-4a69-9a80-aa9768149094	Medium 6.4	—	Before .53.4	`.53.4`	May 11, 2016
CVE-2014-8749	Medium 5	1.9%	.51 and earlier	`.51.1`	December 1, 2014
CVE-2025-67931	Medium 5.3	0.3%	6.9 and earlier	`7.0`	January 6, 2026
CVE-2013-3487	Medium 4.3	2.3%	.48.9 and earlier	`.49`	March 3, 2014

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.