BU
Product
BuddyPress
20
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Severity mix
Critical 0High 10Medium 8Low 0
Watch
Add BuddyPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21389 | 8.8 | Mar 26 | BuddyPress is an open source WordPress plugin to build a community site Affected: 5.0.0 before 7.2.1 |
| CVE-2026-115965 New | 8.5 | Oct 29 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability Affected: through 14.5.2 |
| CVE-2026-111850 New | 8.5 | Oct 28 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability Affected: through 14.5.2 |
| CVE-2026-53673 | 8.1 | Jun 9 | BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter Affected: through 14.4.0 |
| CVE-2024-10011 | 8.1 | Oct 25 | BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal Affected: through 14.1.0 |
| CVE-2026-1360 | 7.5 | Jul 30 | BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data Affected: through 14.5.0 |
| CVE-2025-62022 | 7.5 | Oct 22 | WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability Affected: through 14.3.4 |
| CVE-2020-5244 | 7.5 | Feb 24 | In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed Affected: 5.0.0 before 5.1.2 |
| CVE-2024-11976 | 7.3 | Jan 23 | BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution Affected: through 14.3.3 |
| CVE-2026-53674 | 7.1 | Jun 9 | BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution Affected: through 14.4.0 |
Showing 10