Buddypress

CVE-2026-1360 Jul 30, 04:03 HIGH This Week

PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).

CVE-2026-8155 Jul 31, 06:00 MEDIUM POC PATCH This Month

Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. No CISA KEV listing is present, but the low privilege bar combined with network accessibility makes this a meaningful privacy and integrity risk on any community-facing or multi-tenant WordPress deployment running BuddyPress.

CVE-2025-23798 Jan 22, 15:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eliott Robson Mass Messaging in BuddyPress allows Reflected XSS.2.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-10011 Oct 25, 07:15 HIGH This Week

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-4892 Jun 12, 02:15 MEDIUM PATCH This Month

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-3974 May 14, 15:42 MEDIUM PATCH This Month

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-50880 Dec 29, 12:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.3.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-21389 Mar 26, 21:15 PHP HIGH POC PATCH THREAT This Week

BuddyPress is an open source WordPress plugin to build a community site. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-5244 Feb 24, 18:15 PHP HIGH PATCH This Week

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-6954 Mar 17, 09:59 PHP MEDIUM PATCH This Month

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

CVE-2014-1888 Mar 01, 00:01 MEDIUM This Month

Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2012-2109 Sep 04, 20:55 HIGH POC PATCH This Week

SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.