Buddypress vulnerabilities

Products

• Buddypress 20

Newest

• buddypress WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability CVE-2026-115965 Public exploit 8.5 HighOctober 29, 2026
• buddypress WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability CVE-2026-111850 8.5 HighOctober 28, 2026
• buddypress BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion CVE-2024-12145 4.3 MediumSeptember 11, 2026
• buddypress BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data CVE-2026-1360 7.5 HighJuly 30, 2026
• buddypress BuddyPress 14.4.0 Friends List IDOR via REST API CVE-2026-53675 5.3 MediumJune 9, 2026
• buddypress BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution CVE-2026-53674 7.1 HighJune 9, 2026
• buddypress BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter CVE-2026-53673 Fix available 8.6 HighJune 9, 2026
• buddypress BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-11976 7.3 HighJanuary 23, 2026
• buddypress WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability CVE-2025-62022 7.5 HighOctober 22, 2025
• buddypress, elbowrobo mass messaging in buddypress +1 more WordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-23798 7.1 HighJanuary 22, 2025
• buddypress BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal CVE-2024-10011 8.1 HighOctober 25, 2024
• buddypress BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-4892 6.4 MediumJune 12, 2024
• buddypress BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-3974 6.4 MediumMay 9, 2024
• buddypress WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-50880 6.5 MediumDecember 29, 2023
• buddypress BuddyPress privilege escalation via REST API CVE-2021-21389 Public exploitFix available EPSS 14.8% 8.1 HighMarch 26, 2021
• buddypress Private data exposure via REST API in BuddyPress CVE-2020-5244 Fix available 8.0 HighFebruary 24, 2020
• buddypress The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote... CVE-2014-1889 Public exploit EPSS 10.6% 6.5 MediumApril 10, 2018
• buddypress BuddyPress Docs plugin Improper Privilege Management CVE-2017-6954 Fix available 4.3 MediumMarch 17, 2017
• buddypress Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress... CVE-2014-1888 4.3 MediumFebruary 28, 2014
• buddypress SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of... CVE-2012-2109 Public exploit 7.5 HighSeptember 4, 2012