Buddyboss vulnerabilities

Products

• Platform 7
• Buddyboss 6
• Platform 2

Newest

• buddyboss app BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint CVE-2026-76124 8.8 HighNovember 3, 2026
• boss media buddyboss platform, buddyboss platform +1 more WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability CVE-2026-118082 8.8 HighOctober 29, 2026
• boss media buddyboss platform, buddyboss platform +1 more WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability CVE-2026-56032 9.8 CriticalJune 26, 2026
• buddyboss platform, unknown buddyboss-platform +1 more BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR CVE-2024-12767 3.5 LowMay 15, 2025
• buddyboss platform pro, platform +1 more BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider CVE-2025-1909 9.8 CriticalMay 5, 2025
• boss media buddyboss platform, buddyboss platform +1 more BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function CVE-2024-13859 6.4 MediumMay 2, 2025
• boss media buddyboss platform, buddyboss platform +1 more BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' CVE-2024-13860 6.4 MediumMay 2, 2025
• boss media buddyboss platform, buddyboss theme, buddyboss platform +2 more BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' CVE-2024-13858 6.4 MediumMay 2, 2025
• boss media buddyboss platform, buddyboss platform +1 more BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' CVE-2024-13402 6.4 MediumFebruary 27, 2025
• buddyboss platform, unknown buddyboss-platform +1 more BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR CVE-2024-4886 4.3 MediumJune 5, 2024
• buddyboss, unknown buddyboss-platform +1 more BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment CVE-2024-4750 5.3 MediumJune 4, 2024
• buddyboss buddypress global search WordPress BuddyPress Global Search Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-45755 5.9 MediumOctober 24, 2023
• buddyboss BuddyBoss XSS vulnerability CVE-2023-32671 6.3 MediumOctober 3, 2023
• buddyboss BuddyBoss XSS vulnerability CVE-2023-32670 9.0 CriticalOctober 3, 2023
• buddyboss Authorization Bypass on BuddyBoss CVE-2023-32669 5.4 MediumOctober 3, 2023
• buddyboss BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field. CVE-2021-43334 5.4 MediumJanuary 26, 2022
• buddyboss BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user... CVE-2021-44692 5.3 MediumJanuary 26, 2022
• buddyboss buddymoss media The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. CVE-2018-21014 5.4 MediumSeptember 9, 2019