BBuddyPress

Products

Exploited and recent CVEs

• CVE-2026-115965 High 8.5 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability 0.3%
• CVE-2026-111850 High 8.5 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability 0.2%
• CVE-2024-12145 Medium 4.3 BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion 0.3%
• CVE-2026-1360 High 7.5 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data 1.2%
• CVE-2026-53675 Medium 4.3 BuddyPress 14.4.0 Friends List IDOR via REST API 0.2%
• CVE-2026-53674 High 7.1 BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution 0.4%
• CVE-2026-53673 High 8.1 BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter 0.4%
• CVE-2024-11976 High 7.3 BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution 0.6%
• CVE-2025-62022 High 7.5 WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability 0.4%
• CVE-2024-10011 High 8.1 BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal 1.2%
• CVE-2024-4892 Medium 6.4 BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.4%
• CVE-2024-3974 Medium 6.4 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.4%
• CVE-2021-21389 High 8.1 BuddyPress privilege escalation via REST API 14.8%
• CVE-2020-5244 High 8.0 Private data exposure via REST API in BuddyPress 2.4%