Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how buddypress compares to other vendors in security performance

View Risk Score →

BuddyPress BuddyPressBuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

Risk 34
Severity
5.4
First published (updated )
CVE-2026-8155

BuddyPress BuddyPressBuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

Risk 70
Severity
7.5
First published (updated )
CVE-2026-1360

BuddyPress WordPress pluginBlock, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter

Risk 39
Severity
6.4
First published (updated )
CVE-2026-4653

BuddyPress BuddyPressBuddyPress 14.4.0 Friends List IDOR via REST API

Risk 26
Severity
5.3
First published (updated )
CVE-2026-53675

BuddyPress BuddyPressBuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution

Risk 49
Severity
7.1
First published (updated )
CVE-2026-53674
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

BuddyPress BuddyPressBuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter

Risk 62
Severity
8.6
First published (updated )
CVE-2026-53673

BuddyPress WordPress Plugin BuddyPressWordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting

Risk 39
Severity
5.1
First published (updated )
CVE-2020-37233

BuddyPress BuddyPress Xprofile Custom Fields TypeBuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion

Risk 79
Severity
8.7
First published (updated )
CVE-2018-25308

BuddyPress BuddyPress GroupblogBuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR

Risk 56
Severity
8.8
EPSS
0.02%
First published (updated )
CVE-2026-5144

BuddyPress BuddyPressRestrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update

Risk 27
Severity
5.3
First published (updated )
CVE-2025-12391
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

BuddyPress BuddyPressWordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability

Risk 43
Severity
7.5
First published (updated )
CVE-2025-62022

BuddyPress BuddyPress DocsBuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

Risk 16
Severity
4.3
EPSS
0.03%
First published (updated )
CVE-2025-5526

BuddyPress Push Notification for Post and BuddyPressPush Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi

Risk 86
Severity
9.8
First published (updated )
CVE-2024-6159

BuddyPress Force Password ChangeBuddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update

Risk 21
Severity
4.2
EPSS
0.03%
First published (updated )
CVE-2025-3793

BuddyPress WooCommerce My Account IntegrationBuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update

Risk 22
Severity
4.3
First published (updated )
CVE-2025-1780
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

BuddyPress WooCommerce My Account IntegrationBuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update

Risk 22
Severity
4.3
First published (updated )
CVE-2024-13358

Buddydev Activity Plus Reloaded For Buddypress WordpressActivity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery

Risk 34
Severity
5.4
First published (updated )
CVE-2024-11913

BuddyPress Mass MessagingWordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 27
Severity
7.1
EPSS
0.04%
First published (updated )
CVE-2025-23798

BuddyPress BuddyBuilderBuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure

Risk 22
Severity
4.3
First published (updated )
CVE-2024-10778

BuddyPress Buddypress WordpressBuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

Risk 60
Severity
8.1
First published (updated )
CVE-2024-10011
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

BuddyPress DocsBuddyPress Docs <= 2.2.3 - Reflected Cross-Site Scripting

Risk 28
Severity
6.1
EPSS
0.05%
First published (updated )
CVE-2024-9207

BuddyPress BuddyPressBuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Risk 28
Severity
6.4
EPSS
0.12%
First published (updated )
CVE-2024-4892

BuddyPress BuddyPressBuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Risk 28
Severity
6.4
EPSS
0.07%
First published (updated )
CVE-2024-3974

BuddyPress Buddypress WordpressWordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)

Risk 46
Severity
6.5
First published (updated )
CVE-2023-50880

BuddyPress Buddypress WordpressBuddyPress privilege escalation via REST API

Risk 78
Severity
9
First published (updated )
CVE-2021-21389
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

BuddyPress Buddypress WordpressPrivate data exposure via REST API in BuddyPress

Risk 58
Severity
8
First published (updated )
CVE-2020-5244

BuddyPress Buddypress WordpressThe Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authent…

Risk 38
Severity
6.5
First published (updated )
CVE-2014-1889

composer/buddypress/buddypressAn issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for Wor…

Risk 23
Severity
4.3
First published (updated )
CVE-2017-6954

BuddyPress BuddyPressXSS

Risk 22
Severity
4.3
First published (updated )
CVE-2014-1888

BuddyPress BuddyPressSQL Injection

Risk 52
Severity
7.5
First published (updated )
CVE-2012-2109
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203