Wordpress Buddypress vulnerabilities

• buddypress WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability CVE-2026-115965 Public exploit 8.5 HighOctober 29, 2026
• buddypress WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability CVE-2026-111850 8.5 HighOctober 28, 2026
• buddypress BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion CVE-2024-12145 4.3 MediumSeptember 11, 2026
• unknown buddypress BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR CVE-2026-8155 5.4 MediumJuly 31, 2026
• buddypress BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data CVE-2026-1360 7.5 HighJuly 30, 2026
• buddypress BuddyPress 14.4.0 Friends List IDOR via REST API CVE-2026-53675 5.3 MediumJune 9, 2026
• buddypress BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution CVE-2026-53674 7.1 HighJune 9, 2026
• buddypress BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter CVE-2026-53673 Fix available 8.6 HighJune 9, 2026
• wordpress buddypress WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting CVE-2020-37233 5.1 MediumMay 16, 2026
• buddypress BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-11976 7.3 HighJanuary 23, 2026
• buddypress WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability CVE-2025-62022 7.5 HighOctober 22, 2025
• buddypress BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal CVE-2024-10011 8.1 HighOctober 25, 2024
• buddypress BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-4892 6.4 MediumJune 12, 2024
• asghar hatampoor buddypress cover, buddypress cover project cover +1 more WordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerability CVE-2024-35746 10.0 CriticalJune 10, 2024
• buddypress BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-3974 6.4 MediumMay 9, 2024
• buddypress WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-50880 6.5 MediumDecember 29, 2023
• buddypress BuddyPress privilege escalation via REST API CVE-2021-21389 Public exploitFix available EPSS 14.8% 8.1 HighMarch 26, 2021
• buddypress Private data exposure via REST API in BuddyPress CVE-2020-5244 Fix available 8.0 HighFebruary 24, 2020