WordPress Plugin Vulnerabilities | Page 71 | WPScan

0-9
a
b
c
d
e
f
g
h
i
j
k
l
m
n
o
p
q
r
s
t
u
v
w
x
y
z

Slug

Published

2020-11-28

Title

BuddyPress < 6.4.0 - Lack of Capability Check on Profile Page

Slug

Published

2021-03-17

Title

BuddyPress < 7.2.1 - REST API Privilege Escalation

Slug

Published

2021-03-17

Title

BuddyPress < 7.2.1 - Force a Friendship

Slug

Published

2021-03-17

Title

BuddyPress < 7.2.1 - Read Private Messages

Slug

Published

2021-03-17

Title

BuddyPress < 7.2.1 - Manage BuddyPress Member Types

Slug

Published

2021-03-17

Title

BuddyPress < 7.2.1 - Invite Member to Join Group

Slug

Published

2021-08-18

Title

BuddyPress < 9.1.1 - Activation Key Disclosure

Slug

Published

2021-08-18

Title

BuddyPress < 9.1.1 - SQL Injections

Slug

Published

2021-04-14

Title

BuddyPress < 7.3.0 - Multiple Authenticated REST API Vulnerabilities

Slug

Published

2023-12-26

Title

BuddyPress < 11.3.2 - Contributor+ Stored XSS

Slug

Published

2024-05-03

Title

BuddyPress < 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Slug

Published

2024-06-11

Title

BuddyPress < 12.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Slug

Published

2024-10-24

Title

BuddyPress < 14.2.1 - Authenticated (Subscriber+) Directory Traversal

Slug

Published

2025-09-27

Title

BuddyPress < 14.4.0 - Missing Authorization

Slug

Published

2026-01-22

Title

BuddyPress < 14.3.4 - Unauthenticated Arbitrary Shortcode Execution

Slug

Published

2026-07-13

Title

BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

Slug

Published

2026-07-29

Title

BuddyPress <= 14.5.0 - Subscriber+ PHP Object Injection via XProfile Field Data

Slug

Published

2026-09-10

Title

BuddyPress < 14.3.4 - Insecure Direct Object Reference to Notifications Deletion

Slug

Published

2026-06-09

Title

BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference

Slug

Published

2026-06-09

Title

BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference

Slug

Published

2026-10-26

Title

BuddyPress < 14.5.3 - Authenticated (Subscriber+) SQL Injection

Slug

Published

2026-10-27

Title

BuddyPress < 14.5.3 - Authenticated (Subscriber+) SQL Injection

Slug

buddypress-activity-plus

Published

2015-07-14

Title

BuddyPress Activity Plus < 1.6.2 - Cross-Site Request Forgery (CSRF)

Slug

buddypress-check-ins-pro

Published

2022-04-11

Title

Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation

Slug

buddypress-component-stats

Published

2020-03-24

Title

Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)