CVE-2026-56032 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. |
CVE-2024-12767 | Low | 3.5 | 2025-05-15 | The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts |
CVE-2025-1909 | Critical | 9.8 | 2025-05-05 | The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient ve… |
CVE-2024-13860 | Medium | 6.4 | 2025-05-02 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and includi… |
CVE-2024-13859 | Medium | 6.4 | 2025-05-02 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, a… |
CVE-2024-13858 | Medium | 6.4 | 2025-05-02 | The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions u… |
CVE-2024-13402 | Medium | 6.4 | 2025-02-27 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2… |
CVE-2024-4886 | Medium | 4.3 | 2024-06-05 | The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request |
CVE-2024-4750 | Medium | 5.3 | 2024-06-04 | The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included i… |
CVE-2023-45755 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BuddyBoss BuddyPress Global Search plugin <= 1.2.1 versions. |
CVE-2023-32671 | Medium | 6.3 | 2023-10-03 | A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript… |
CVE-2023-32670 | Critical | 9.0 | 2023-10-03 | Cross-Site Scripting vulnerability
in BuddyBoss 2.2.9 version
, which could allow a local attacker with basic privileges to execute a malicious payload thro… |
CVE-2023-32669 | Medium | 5.4 | 2023-10-03 | Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' al… |
CVE-2021-44692 | Medium | 5.3 | 2022-01-26 | BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their… |
CVE-2021-43334 | Medium | 5.4 | 2022-01-26 | BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field. |
CVE-2018-21014 | Medium | 5.4 | 2019-09-09 | The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. |