Skip to contentBuddyboss Buddyboss vulnerabilities
- buddyboss appBuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback EndpointCVE-2026-761248.8 High
- boss media buddyboss platform, buddyboss platform +1 moreWordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerabilityCVE-2026-1180828.8 High
- boss media buddyboss platform, buddyboss platform +1 moreWordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerabilityCVE-2026-560329.8 Critical
- buddyboss platform, unknown buddyboss-platform +1 moreBuddyBoss platform < 2.7.60 - Private Comment Exposure via IDORCVE-2024-127673.5 Low
- buddyboss platform pro, platform +1 moreBuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth providerCVE-2025-19099.8 Critical
- boss media buddyboss platform, buddyboss platform +1 moreBuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' functionCVE-2024-138596.4 Medium
- boss media buddyboss platform, buddyboss platform +1 moreBuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'CVE-2024-138606.4 Medium
- boss media buddyboss platform, buddyboss theme, buddyboss platform +2 moreBuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'CVE-2024-138586.4 Medium
- boss media buddyboss platform, buddyboss platform +1 moreBuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'CVE-2024-134026.4 Medium
- buddyboss platform, unknown buddyboss-platform +1 moreBuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDORCVE-2024-48864.3 Medium
- buddyboss, unknown buddyboss-platform +1 moreBuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like CommentCVE-2024-47505.3 Medium
- buddybossBuddyBoss XSS vulnerabilityCVE-2023-326716.3 Medium
- buddybossBuddyBoss XSS vulnerabilityCVE-2023-326709.0 Critical
- buddybossAuthorization Bypass on BuddyBossCVE-2023-326695.4 Medium
- buddybossBuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.CVE-2021-433345.4 Medium
- buddybossBuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user...CVE-2021-446925.3 Medium