BU
Product
BuddyPress
19
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 9Medium 8Low 0
Watch
Add BuddyPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21389 | 8.8 | Mar 26 | BuddyPress is an open source WordPress plugin to build a community site Affected: 5.0.0 before 7.2.1 |
| CVE-2026-111850 New | 8.5 | Oct 28 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability Affected: through 14.5.2 |
| CVE-2026-53673 | 8.1 | Jun 9 | BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter Affected: through 14.4.0 |
| CVE-2024-10011 | 8.1 | Oct 25 | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter Affected: through 14.1.0 |
| CVE-2026-1360 | 7.5 | Jul 30 | BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data Affected: through 14.5.0 |
| CVE-2025-62022 | 7.5 | Oct 22 | WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability Affected: through 14.3.4 |
| CVE-2020-5244 | 7.5 | Feb 24 | In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed Affected: 5.0.0 before 5.1.2 |
| CVE-2024-11976 | 7.3 | Jan 23 | BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution Affected: through 14.3.3 |
| CVE-2026-53674 | 7.1 | Jun 9 | BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution Affected: through 14.4.0 |
| CVE-2014-1889 | 6.5 | Apr 10 | The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing… Affected: before 1.9.2 |
| CVE-2025-23798 | 6.1 | Jan 22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows… Affected: through 2.2.1 |
| CVE-2024-4892 | 5.4 | Jun 12 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient… Affected: before 12.5.1 |
| CVE-2024-3974 | 5.4 | May 14 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input… Affected: before 12.4.1 |
| CVE-2023-50880 | 5.4 | Dec 29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects… Affected: through 11.3.1 |
| CVE-2024-12145 | 4.3 | Sep 11 | BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion Affected: through 14.3.3 |
| CVE-2026-53675 | 4.3 | Jun 9 | BuddyPress 14.4.0 Friends List IDOR via REST API Affected: through 14.4.0 |
| CVE-2017-6954 | 4.3 | Mar 17 | An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress Affected: through 1.9.2 |
| CVE-2014-1888 | – | Mar 1 | Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name… Affected: through 1.9; 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.3.1; +16 more |
| CVE-2012-2109 | – | Sep 4 | SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page… Affected: 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.3.1; 1.5.4 |
Showing 19