BuddyBoss Platform

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   BuddyBoss Platform

Information

Software Type Plugin
Software Slug buddyboss-platform
Software Status Active
Software Author Boss Media
Software Website www.buddyboss.com
Software Active Installs 29,528
Software Record Last Updated May 20, 2025

10 Vulnerabilities

Submit a Vulnerability
BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection
7.5
CVE-2026-59514
Jul 9, 2026
Researcher: VDsec
BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVE-2026-56032
Jun 23, 2026
Researcher: dutafi
BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'
6.4
CVE-2024-13858
May 1, 2025
Researcher: Kaique Peres
BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function
6.4
CVE-2024-13859
May 1, 2025
Researcher: Kaique Peres
BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'
6.4
CVE-2024-13860
May 1, 2025
Researcher: Kaique Peres
BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'
6.4
CVE-2024-13402
Feb 26, 2025
Researcher: mikemyers
BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure
4.3
CVE-2024-12767
Jan 14, 2025
Researcher: Faris Krivic
Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post
4.3
CVE-2024-4886
May 15, 2024
Researcher: Faris Krivic
Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post
4.3
CVE-2024-4750
May 14, 2024
Researcher: Faris Krivic
Buddyboss Platform <= 1.7.8 - SQL Injection
7.2
CVE ID Unknown
Sep 16, 2021
Researchers:
Title Status CVE ID CVSS Researchers Date
BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection Patched CVE-2026-59514 7.5 VDsec July 9, 2026
BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection Patched CVE-2026-56032 7.5 dutafi June 23, 2026
BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' Patched CVE-2024-13858 6.4 Kaique Peres May 1, 2025
BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function Patched CVE-2024-13859 6.4 Kaique Peres May 1, 2025
BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' Patched CVE-2024-13860 6.4 Kaique Peres May 1, 2025
BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' Patched CVE-2024-13402 6.4 mikemyers February 26, 2025
BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure Patched CVE-2024-12767 4.3 Faris Krivic January 14, 2025
Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post Patched CVE-2024-4886 4.3 Faris Krivic May 15, 2024
Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post Patched CVE-2024-4750 4.3 Faris Krivic May 14, 2024
Buddyboss Platform <= 1.7.8 - SQL Injection Patched 7.2 September 16, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation