BU
Vendor
buddypress
19
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111850 New | BU BuddyPress BuddyPress | 8.5 | Oct 28 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability |
| CVE-2024-12145 | BU BuddyPress buddypress | 4.3 | Sep 11 | BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion |
| CVE-2026-1360 | BU BuddyPress buddypress | 7.5 | Jul 30 | BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data |
| CVE-2026-53675 | BU BuddyPress BuddyPress | 4.3 | Jun 9 | BuddyPress 14.4.0 Friends List IDOR via REST API |
| CVE-2026-53674 | BU BuddyPress BuddyPress | 7.1 | Jun 9 | BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution |
| CVE-2026-53673 | BU BuddyPress BuddyPress | 8.1 | Jun 9 | BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter |
| CVE-2024-11976 | BU BuddyPress buddypress | 7.3 | Jan 23 | BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution |
| CVE-2025-62022 | BU BuddyPress BuddyPress | 7.5 | Oct 22 | WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability |
| CVE-2025-23798 | BU Buddypress Buddypress | 6.1 | Jan 22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows… |
| CVE-2024-10011 | BU Buddypress Buddypress | 8.1 | Oct 25 | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter |
| CVE-2024-4892 | BU Buddypress Buddypress | 5.4 | Jun 12 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient… |
| CVE-2024-3974 | BU Buddypress Buddypress | 5.4 | May 14 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input… |
| CVE-2023-50880 | BU Buddypress Buddypress | 5.4 | Dec 29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects… |
| CVE-2021-21389 | BU Buddypress Buddypress | 8.8 | Mar 26 | BuddyPress is an open source WordPress plugin to build a community site |
| CVE-2020-5244 | BU Buddypress Buddypress | 7.5 | Feb 24 | In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed |
| CVE-2014-1889 | BU Buddypress Buddypress | 6.5 | Apr 10 | The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing… |
| CVE-2017-6954 | BU Buddypress Buddypress | 4.3 | Mar 17 | An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress |
| CVE-2014-1888 | BU Buddypress Buddypress | – | Mar 1 | Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name… |
| CVE-2012-2109 | BU Buddypress Buddypress | – | Sep 4 | SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page… |