BuddyPress

Software Type	Plugin
Software Slug	buddypress (view on wordpress.org)
Software Status	Active
Software Author	buddypress
Software Website	buddypress.org
Software Downloads	13,934,879
Software Active Installs	90,000
Software Record Last Updated	October 14, 2026

Showing 1-20 of 29 Vulnerabilities

Submit a Vulnerability

BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

4.3

CVE-2024-12145

Sep 10, 2026

Researcher: Brian Mungai

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

7.5

CVE-2026-1360

Jul 29, 2026

Researcher: Vincent Theriault-Laine

BuddyPress <= 14.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure

4.3

CVE-2026-8155

Jul 13, 2026

Researcher: Mustafa Ahmed

BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference

4.3

CVE-2026-53675

Jun 9, 2026

Researcher: Scott Moore

BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference

4.3

CVE-2026-53673

Jun 9, 2026

Researcher: Scott Moore

BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution

7.3

CVE-2024-11976

Jan 22, 2026

Researcher: mikemyers

BuddyPress <= 14.3.4 - Missing Authorization

5.3

CVE-2025-62022

Sep 27, 2025

Researcher: Asim Alshaya (AsimCr0)

BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

8.1

CVE-2024-10011

Oct 24, 2024

Researcher: Dominik Dziura (Domons)

BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVE-2024-4892

Jun 11, 2024

Researcher: wesley (wcraft)

BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVE-2024-3974

May 3, 2024

Researcher: wesley (wcraft)

BuddyPress <= 11.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-50880

Dec 26, 2023

Researcher: Rafie Muhammad

BuddyPress <= 9.0.0 - SQL Injection

9.8

CVE ID Unknown

Aug 18, 2021

Researcher: David Cavins

BuddyPress <= 9.0.0 - Information Disclosure via REST API

8.8

CVE ID Unknown

Aug 18, 2021

Researcher: Brajesh Singh

BuddyPress <= 7.2.1 - Insufficient Privilege De-escalation

8.8

CVE ID Unknown

Apr 14, 2021

Researcher: Kien Hoang

BuddyPress <= 7.2.1 - Missing Authorization to Private Post Activity

5.4

CVE ID Unknown

Apr 14, 2021

Researcher: Kien Hoang

BuddyPress <= 7.2.1 - Missing Authorization to Group Creation

5.4

CVE ID Unknown

Apr 14, 2021

Researcher: Kien Hoang

BuddyPress <= 7.2.1 - Missing Authorization to Unauthorized Group Access

5.4

CVE ID Unknown

Apr 14, 2021

Researcher: Kien Hoang

BuddyPress <= 7.2.0 - Authorization Bypass to Friend Invite

5.4

CVE ID Unknown

Mar 17, 2021

Researcher: Kien Hoang

BuddyPress 5.0.0-7.2.0 - Privilege Escalation via REST API

8.8

CVE-2021-21389

Mar 16, 2021

Researcher: Kien

BuddyPress - 7.0.0 - 7.2.0 - Insufficient Privilege De-escalation

4.6

CVE ID Unknown

Mar 16, 2021

Researchers:

Title	Status	CVE ID	CVSS	Researchers	Date
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion	Patched	CVE-2024-12145	4.3	Brian Mungai	September 10, 2026
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data	Unpatched	CVE-2026-1360	7.5	Vincent Theriault-Laine	July 29, 2026
BuddyPress <= 14.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure	Patched	CVE-2026-8155	4.3	Mustafa Ahmed	July 13, 2026
BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference	Unpatched	CVE-2026-53675	4.3	Scott Moore	June 9, 2026
BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference	Unpatched	CVE-2026-53673	4.3	Scott Moore	June 9, 2026
BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution	Patched	CVE-2024-11976	7.3	mikemyers	January 22, 2026
BuddyPress <= 14.3.4 - Missing Authorization	Patched	CVE-2025-62022	5.3	Asim Alshaya (AsimCr0)	September 27, 2025
BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal	Patched	CVE-2024-10011	8.1	Dominik Dziura (Domons)	October 24, 2024
BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Patched	CVE-2024-4892	6.4	wesley (wcraft)	June 11, 2024
BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Patched	CVE-2024-3974	6.4	wesley (wcraft)	May 3, 2024
BuddyPress <= 11.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2023-50880	6.4	Rafie Muhammad	December 26, 2023
BuddyPress <= 9.0.0 - SQL Injection	Patched		9.8	David Cavins	August 18, 2021
BuddyPress <= 9.0.0 - Information Disclosure via REST API	Patched		8.8	Brajesh Singh	August 18, 2021
BuddyPress <= 7.2.1 - Insufficient Privilege De-escalation	Patched		8.8	Kien Hoang	April 14, 2021
BuddyPress <= 7.2.1 - Missing Authorization to Private Post Activity	Patched		5.4	Kien Hoang	April 14, 2021
BuddyPress <= 7.2.1 - Missing Authorization to Group Creation	Patched		5.4	Kien Hoang	April 14, 2021
BuddyPress <= 7.2.1 - Missing Authorization to Unauthorized Group Access	Patched		5.4	Kien Hoang	April 14, 2021
BuddyPress <= 7.2.0 - Authorization Bypass to Friend Invite	Patched		5.4	Kien Hoang	March 17, 2021
BuddyPress 5.0.0-7.2.0 - Privilege Escalation via REST API	Patched	CVE-2021-21389	8.8	Kien	March 16, 2021
BuddyPress - 7.0.0 - 7.2.0 - Insufficient Privilege De-escalation	Patched		4.6		March 16, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation