WordPress Plugin Vulnerabilities

BuddyPress 1.2.9 - SQL Injection

Description

The BuddyPress WordPress plugin was affected by a SQL Injection security vulnerability.

Affects Plugins

Plugin icon
buddypress
Fixed in 1.2.10

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89

Miscellaneous

Verified
No
WPVDB ID
a749218c-ed32-4f44-95d6-a87abce5c3e1

Timeline

Publicly Published
2014-08-01 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2015-05-15 (about 10 years ago)

Other

Published
Title
Published
2025-07-28
Title
Bricks Builder < 2.0 - Unauthenticated SQL Injection via `p` Parameter
Published
2026-01-14
Title
Simply Schedule Appointments < 1.6.9.13 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters
Published
2014-08-01
Title
WP Symposium < 12.07.01 - Multiple SQL Injections
Published
2024-03-26
Title
DecaLog < 3.9.1 - Authenticated (Admin+) SQL injection
Published
2025-06-05
Title
Hydra Booking < 1.1.11 - Authenticated (Contributor+) SQL Injection