PLUGIN SECURITY
Is BulletProof Security safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the BulletProof Security WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
bulletproof-security
Maintenance status
Known vulnerabilities
11 known CVEs on file for BulletProof Security. Reported between 2012 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-67931 | BulletProof Security [bulletproof-security] < 7.0 | Insertion of Sensitive Information Into Sent Data | High 7.5 | < 7.0 | 7.0 | 2026-01-06 | — |
| CVE-2026-119273 | BulletProof Security [bulletproof-security] <= 7.2 (unfixed) | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 7.2 | 7.2 | 2026-01-06 | — |
| CVE-2022-1265 | BulletProof Security [bulletproof-security] < 6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 6.1 | 6.1 | 2022-04-19 | — |
| CVE-2022-0590 | BulletProof Security [bulletproof-security] < 5.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 5.8 | 5.8 | 2022-02-22 | — |
| CVE-2021-39327 | BulletProof Security [bulletproof-security] < 5.2 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 5.2 | 5.2 | 2021-09-16 | — |
| — | BulletProof Security [bulletproof-security] < 0.53.3 | — | Unknown | < 0.53.3 | 0.53.3 | 2016-05-11 | — |
| — | BulletProof Security [bulletproof-security] < 0.53.4 | — | Unknown | < 0.53.4 | 0.53.4 | 2016-05-11 | — |
| — | BulletProof Security [bulletproof-security] < 0.53.4 | — | Unknown | < 0.53.4 | 0.53.4 | 2016-05-11 | — |
+ 15 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | BulletProof Security [bulletproof-security] < 0.53.3 | — | Unknown | < 0.53.3 | 0.53.3 | 2016-03-17 | — |
| — | BulletProof Security [bulletproof-security] < 0.52.5 | — | Unknown | < 0.52.5 | 0.52.5 | 2015-10-27 | — |
| — | BulletProof Security [bulletproof-security] < 0.52.5 | — | Unknown | < 0.52.5 | 0.52.5 | 2015-09-20 | — |
| CVE-2014-8749 | BulletProof Security [bulletproof-security] < 0.51.1 | — | Unknown | < 0.51.1 | 0.51.1 | 2014-10-13 | — |
| CVE-2014-7958, CVE-2014-7959, CVE-2014-8749 | BulletProof Security [bulletproof-security] < 0.51.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 0.51.1 | 0.51.1 | 2014-10-07 | — |
| CVE-2014-7959 | BulletProof Security [bulletproof-security] < 0.51.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 0.51.1 | 0.51.1 | 2014-10-07 | — |
| CVE-2015-9230 | BulletProof Security [bulletproof-security] < 0.52.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 0.52.5 | 0.52.5 | 2014-09-30 | — |
| CVE-2013-3487 | BulletProof Security [bulletproof-security] < 0.49 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 0.49 | 0.49 | 2013-05-07 | — |
| CVE-2012-4268 | BulletProof Security [bulletproof-security] < 0.47.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 0.47.1 | 0.47.1 | 2012-05-11 | — |
| — | BulletProof Security [bulletproof-security] < 0.53.4 | — | Unknown | < 0.53.4 | 0.53.4 | — | — |
| — | BulletProof Security [bulletproof-security] < 0.53.3 | — | Unknown | < 0.53.3 | 0.53.3 | — | — |
| — | BulletProof Security [bulletproof-security] < 0.52.5 | — | Unknown | < 0.52.5 | 0.52.5 | — | — |
| — | BulletProof Security <= .52.4 - Authenticated Cross-Site Scripting (XSS) | — | Unknown | < .52.5 | .52.5 | — | — |
| — | Bulletproof Security <= .53.2 - Multiple Cross Site Scripting Vulnerabilities | — | Unknown | < .53.3 | .53.3 | — | — |
| — | BulletProof Security <= .53.3 - Multiple XSS Vulnerabilities | — | Unknown | < .53.4 | .53.4 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.