Plugin icon

BuddyPress

buddypress

Vulnerabilities:

24

Last Updated:

September 24, 2025

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-01-22
Title
BuddyPress < 14.3.4 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 14.3.4
CVSS
7.3 (high)
Published
2025-09-27
Title
BuddyPress < 14.4.0 - Missing Authorization
Fixed in
Fixed in 14.4.0
CVSS
5.3 (medium)
Published
2024-10-24
Title
BuddyPress < 14.2.1 - Authenticated (Subscriber+) Directory Traversal
Fixed in
Fixed in 14.2.1
CVSS
8.1 (high)
Published
2024-06-11
Title
BuddyPress < 12.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 12.5.1
CVSS
6.4 (medium)
Published
2024-05-03
Title
BuddyPress < 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 12.4.1
CVSS
6.4 (medium)
Published
2023-12-26
Title
BuddyPress < 11.3.2 - Contributor+ Stored XSS
Fixed in
Fixed in 11.3.2
CVSS
5.9 (medium)
Published
2021-08-18
Title
BuddyPress < 9.1.1 - Activation Key Disclosure
Fixed in
Fixed in 9.1.1
CVSS
5.8 (medium)
Published
2021-08-18
Title
BuddyPress < 9.1.1 - SQL Injections
Fixed in
Fixed in 9.1.1
CVSS
8.5 (high)
Published
2021-04-14
Title
BuddyPress < 7.3.0 - Multiple Authenticated REST API Vulnerabilities
Fixed in
Fixed in 7.3.0
CVSS
5.4 (medium)
Published
2021-03-17
Title
BuddyPress < 7.2.1 - Read Private Messages
Fixed in
Fixed in 7.2.1
CVSS
4.3 (medium)
Published
2021-03-17
Title
BuddyPress < 7.2.1 - Invite Member to Join Group
Fixed in
Fixed in 7.2.1
CVSS
4.3 (medium)
Published
2021-03-17
Title
BuddyPress < 7.2.1 - Force a Friendship
Fixed in
Fixed in 7.2.1
CVSS
4.3 (medium)
Published
2021-03-17
Title
BuddyPress < 7.2.1 - Manage BuddyPress Member Types
Fixed in
Fixed in 7.2.1
CVSS
4.3 (medium)
Published
2021-03-17
Title
BuddyPress < 7.2.1 - REST API Privilege Escalation
Fixed in
Fixed in 7.2.1
CVSS
8.3 (high)
Published
2020-11-28
Title
BuddyPress < 6.4.0 - Lack of Capability Check on Profile Page
Fixed in
Fixed in 6.4.0
CVSS
5.4 (medium)
Published
2020-01-03
Title
BuddyPress 5.0.0-5.1.1 - Private Data Exposure via REST API
Fixed in
Fixed in 5.1.2
CVSS
7.5 (high)
Published
2019-12-23
Title
BuddyPress < 5.1.1 - Denial of Service
Fixed in
Fixed in 5.1.1
CVSS
n/a
Published
2016-12-23
Title
BuddyPress 2.0-2.7.3 - Arbitrary File Deletion
Fixed in
Fixed in 2.7.4
CVSS
n/a
Published
2015-11-11
Title
BuddyPress <= 2.3.4 - Authenticated Privilege Escalation
Fixed in
Fixed in 2.3.5
CVSS
n/a
Published
2014-08-01
Title
Buddypress <= 1.9.1 - Crafted bp_new_group_id Cookie Arbitrary Group Manipulation
Fixed in
Fixed in 1.9.2
CVSS
6.5 (medium)
Published
2014-08-01
Title
BuddyPress 1.7.1 - Multiple SQL Injections
Fixed in
Fixed in 1.7.2
CVSS
n/a
Published
2014-08-01
Title
BuddyPress 1.2.9 - SQL Injection
Fixed in
Fixed in 1.2.10
CVSS
n/a
Published
2014-08-01
Title
Buddypress <= 1.9.1 - Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.9.2
CVSS
n/a
Published
2012-03-31
Title
Buddypress <= 1.5.4 - SQL Injection
Fixed in
Fixed in 1.5.5
CVSS
n/a