CVE-2026-1360 | High | 7.5 | 2026-07-30 | The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unse… |
CVE-2026-53675 | Medium | 4.3 | 2026-06-10 | BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate anothe… |
CVE-2026-53674 | High | 7.1 | 2026-06-10 | BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, all… |
CVE-2026-53673 | High | 8.1 | 2026-06-10 | BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary p… |
CVE-2024-11976 | High | 7.3 | 2026-01-23 | The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the softwar… |
CVE-2025-62022 | High | 7.5 | 2025-10-22 | Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4. |
CVE-2025-23798 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-… |
CVE-2024-10011 | High | 8.1 | 2024-10-25 | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possi… |
CVE-2024-4892 | Medium | 6.4 | 2024-06-12 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due… |
CVE-2024-3974 | Medium | 6.4 | 2024-05-14 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to… |
CVE-2023-50880 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.Thi… |
CVE-2021-21389 | High | 8.1 | 2021-03-26 | BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged… |
CVE-2020-5244 | High | 8.0 | 2020-02-24 | In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has bee… |
CVE-2014-1889 | Medium | 6.5 | 2018-04-10 | The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leverag… |
CVE-2017-6954 | Medium | 4.3 | 2017-03-17 | An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit docu… |
CVE-2014-1888 | | | 2014-03-01 | Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script o… |
CVE-2012-2109 | | | 2012-09-04 | SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands v… |