BU
Vendor
BuddyBoss
17
CVEs
0
On KEV
0
New 30D
Products
BP9.8
Buddyboss Platform
BuddyBoss
8 CVEs0 on KEV0 new
BU5.4
Buddyboss
Buddyboss
6 CVEs0 on KEV0 new
BP9.8
BuddyBoss Platform Pro
BuddyBoss
1 CVEs0 on KEV0 new
BM5.4
Buddymoss Media
Buddyboss
1 CVEs0 on KEV0 new
BG4.8
Buddypress Global Search
Buddyboss
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-56032 | BP Buddyboss Platform BuddyBoss | 9.8 | Jun 26 | WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability |
| CVE-2024-12767 | BP Buddyboss Platform Buddyboss | 3.5 | May 15 | BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR |
| CVE-2025-1909 | BP BuddyBoss Platform Pro BuddyBoss | 9.8 | May 5 | BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider |
| CVE-2024-13859 | BP Buddyboss Platform Buddyboss | 5.4 | May 2 | BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function |
| CVE-2024-13860 | BP Buddyboss Platform Buddyboss | 5.4 | May 2 | BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' |
| CVE-2024-13858 | BP Buddyboss Platform Buddyboss | 5.4 | May 2 | BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' |
| CVE-2024-13402 | BP Buddyboss Platform Buddyboss | 5.4 | Feb 27 | BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' |
| CVE-2024-4886 | BP Buddyboss Platform Buddyboss | 4.3 | Jun 5 | BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR |
| CVE-2024-4750 | BU Buddyboss Buddyboss | 5.3 | Jun 4 | BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment |
| CVE-2023-45755 | BG Buddypress Global Search Buddyboss | 4.8 | Oct 25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BuddyBoss BuddyPress Global Search plugin <= 1.2.1 versions |
| CVE-2023-32671 | BU Buddyboss Buddyboss | 5.4 | Oct 3 | A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9 |
| CVE-2023-32670 | BU Buddyboss Buddyboss | 5.4 | Oct 3 | Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the… |
| CVE-2023-32669 | BU Buddyboss Buddyboss | 5.4 | Oct 3 | Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums |
| CVE-2021-44692 | BU Buddyboss Buddyboss | 5.3 | Jan 26 | BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user |
| CVE-2021-43334 | BU Buddyboss Buddyboss | 5.4 | Jan 26 | BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field |
| CVE-2018-21014 | BM Buddymoss Media Buddyboss | 5.4 | Sep 9 | The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS |