Buddyboss Platform
Monthly
Privilege escalation in the BuddyBoss Platform WordPress plugin through version 3.5.0 allows an authenticated low-privileged subscriber to gain higher privileges over the network without user interaction, with a CVSS score of 8.8. The flaw is an incorrect privilege assignment (CWE-266) affecting WordPress community sites running the plugin, and exposure is greatest where subscriber self-registration is open. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
SQL injection in the BuddyBoss Platform WordPress plugin (versions 3.1.0 and earlier) lets an authenticated low-privilege user - specifically a subscriber-level account - inject SQL through a plugin input that is not safely parameterized, exposing data stored in the site's database. Because BuddyBoss powers community and social-networking sites that very often leave open user self-registration enabled, the Subscriber role required by the vector (PR:L) is usually trivial to obtain, and no user interaction or non-default configuration is needed beyond a valid account. The vendor CVSS base score is 8.5 (High) with scope change, high confidentiality impact and low availability impact; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated SQL injection in the BuddyBoss Platform WordPress plugin (versions <= 3.0.5) lets remote attackers inject arbitrary SQL through unsanitized input, exposing database contents without any login. Rated CVSS 9.3 (scope-changed) and reported by Patchstack; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The network-reachable, no-authentication nature makes it a high-priority patch for any site running the community/social-networking plugin.
Stored cross-site scripting in the BuddyBoss Platform WordPress plugin (all versions through 3.6.0) lets a Subscriber-level account persist arbitrary script in a social group's name, which then executes in the browser of any user viewing that group page. Exploitation depends on the plugin's 'Enable social group creation by all members' setting - enabled by default, letting low-privilege users create groups - and is not possible where group creation has been restricted to administrators. A public advisory and release notes for version 3.7.0 are available; no KEV listing or confirmed exploit code is in the supplied data, and the assessed impact is moderate (CVSS 6.4, scope-changed, low confidentiality and integrity impact).
The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in the BuddyBoss Platform WordPress plugin through version 3.5.0 allows an authenticated low-privileged subscriber to gain higher privileges over the network without user interaction, with a CVSS score of 8.8. The flaw is an incorrect privilege assignment (CWE-266) affecting WordPress community sites running the plugin, and exposure is greatest where subscriber self-registration is open. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
SQL injection in the BuddyBoss Platform WordPress plugin (versions 3.1.0 and earlier) lets an authenticated low-privilege user - specifically a subscriber-level account - inject SQL through a plugin input that is not safely parameterized, exposing data stored in the site's database. Because BuddyBoss powers community and social-networking sites that very often leave open user self-registration enabled, the Subscriber role required by the vector (PR:L) is usually trivial to obtain, and no user interaction or non-default configuration is needed beyond a valid account. The vendor CVSS base score is 8.5 (High) with scope change, high confidentiality impact and low availability impact; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated SQL injection in the BuddyBoss Platform WordPress plugin (versions <= 3.0.5) lets remote attackers inject arbitrary SQL through unsanitized input, exposing database contents without any login. Rated CVSS 9.3 (scope-changed) and reported by Patchstack; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The network-reachable, no-authentication nature makes it a high-priority patch for any site running the community/social-networking plugin.
Stored cross-site scripting in the BuddyBoss Platform WordPress plugin (all versions through 3.6.0) lets a Subscriber-level account persist arbitrary script in a social group's name, which then executes in the browser of any user viewing that group page. Exploitation depends on the plugin's 'Enable social group creation by all members' setting - enabled by default, letting low-privilege users create groups - and is not possible where group creation has been restricted to administrators. A public advisory and release notes for version 3.7.0 are available; no KEV listing or confirmed exploit code is in the supplied data, and the assessed impact is moderate (CVSS 6.4, scope-changed, low confidentiality and integrity impact).
The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.