Login Request a demo
BU
Product
BuddyPress
by buddypress · last CVE Oct 28, 2026
19
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 0High 9Medium 8Low 0
Severity
All severities19Critical0High9Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add BuddyPress to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2014-1889
6.5
11%
Apr 10
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing…
Affected: before 1.9.2
CVE-2025-23798
6.1
0%
Jan 22
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows…
Affected: through 2.2.1
CVE-2024-4892
5.4
0%
Jun 12
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient…
Affected: before 12.5.1
CVE-2024-3974
5.4
0%
May 14
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input…
Affected: before 12.4.1
CVE-2023-50880
5.4
0%
Dec 29
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects…
Affected: through 11.3.1
CVE-2024-12145
4.3
0%
Sep 11
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
Affected: through 14.3.3
CVE-2026-53675
4.3
0%
Jun 9
BuddyPress 14.4.0 Friends List IDOR via REST API
Affected: through 14.4.0
CVE-2017-6954
4.3
1%
Mar 17
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress
Affected: through 1.9.2
Showing 8