Advisories · Technology
BuddyPress.
Every CVE that names BuddyPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
- BuddyPress
- SQL injection
- CVSS 8.5 High
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
- BuddyPress
- SQL injection
- CVSS 4.3 Medium
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
- BuddyPress
- Broken access control
- CVSS 5.4 Medium
BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
- BuddyPress
- Broken access control
- CVSS 7.5 High
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
- BuddyPress
- Insecure deserialization
- CVSS 7.1 High
BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution
- BuddyPress
- Other injection
- CVSS 7.3 High
BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution
- BuddyPress
- Code injection
- CVSS 7.5 High
WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability
- BuddyPress
- Broken access control
- CVSS 8.1 High
BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal
- BuddyPress
- Path traversal
- CVSS 6.4 Medium
BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- BuddyPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- BuddyPress
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)
- BuddyPress
- Cross-site scripting (XSS)