Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

BuddyPress — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in BuddyPress, with AI-generated Chinese analysis, references, and POCs.

This page documents known security weaknesses associated with BuddyPress, a widely used WordPress plugin developed by BuddyPress. It aggregates vulnerability data from various sources to provide a comprehensive view of security issues affecting this specific software component. The collection includes details on various weakness types such as SQL injection, cross-site scripting, and improper access control, covering incidents reported over the past several years. This timeframe allows for a robust analysis of both historical trends and recent security developments within the plugin’s ecosystem. By visiting this page, users can track advisories issued by the vendor and community members, gaining insight into how specific bugs were reported and patched. It also serves as a resource for understanding the context and severity of different weakness classes as they apply to BuddyPress. Furthermore, individuals can look up the product’s vulnerability history to assess past security risks and evaluate the overall resilience of the software. This information is essential for developers, site administrators, and security professionals who need to maintain secure WordPress environments. The aggregated data helps in identifying patterns, prioritizing patches, and ensuring that all known issues are addressed effectively. This approach supports better decision-making and enhances the security posture of sites relying on this plugin, fostering a safer web experience for all users.

Vendor: buddypress

CVE ID Title CVSS Severity Published
CVE-2024-12145 BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion CWE-862 4.3 Medium 2026-09-11
CVE-2026-8155 BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR - - 2026-07-31
CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data CWE-502 7.5 High 2026-07-30
CVE-2026-53675 BuddyPress 14.4.0 Friends List IDOR via REST API CWE-639 4.3 Medium 2026-06-09
CVE-2026-53673 BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter CWE-639 8.1 High 2026-06-09
CVE-2026-53674 BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution CWE-943 7.1 High 2026-06-09
CVE-2020-37233 WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting CWE-79 6.4 Medium 2026-05-16
CVE-2024-11976 BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution CWE-94 7.3 High 2026-01-23
CVE-2025-62022 WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability CWE-862 7.5 High 2025-10-22
CVE-2024-10011 BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal CWE-22 8.1 High 2024-10-25
CVE-2024-4892 BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-06-12
CVE-2024-3974 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-05-09
CVE-2023-50880 WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS) CWE-79 6.5 Medium 2023-12-29
CVE-2021-21389 BuddyPress privilege escalation via REST API CWE-863 8.1 High 2021-03-26
CVE-2020-5244 Private data exposure via REST API in BuddyPress CWE-284 8.0 High 2020-02-24

All 15 known CVE vulnerabilities affecting BuddyPress with full Chinese analysis, references, and POCs where available.