buddypress vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20211
3. 20243
4. 20251
5. 20268

Newest CVEs

• CVE-2026-115965

  WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

  BuddyPress · BuddyPress

  High8.5
• CVE-2026-111850

  WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

  BuddyPress · BuddyPress

  High8.5
• CVE-2024-12145

  BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

  buddypress · BuddyPress

  Medium4.3
• CVE-2026-1360

  BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

  buddypress · BuddyPress

  High7.5
• CVE-2026-53675

  BuddyPress 14.4.0 Friends List IDOR via REST API

  BuddyPress · BuddyPress

  Medium5.3
• CVE-2026-53674

  BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution

  BuddyPress · BuddyPress

  High7.1
• CVE-2026-53673

  BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter

  BuddyPress · BuddyPress

  High8.6
• CVE-2024-11976

  BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution

  buddypress · BuddyPress

  High7.3
• CVE-2025-62022

  WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability

  BuddyPress · BuddyPress

  High7.5
• CVE-2024-10011

  BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

  buddypress · BuddyPress

  High8.1