WordPress plugin vulnerabilities
BuddyPress vulnerabilities
Known security issues in the BuddyPress WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.
- Plugin slug
- buddypress
- Latest version
- 14.5.2
- Active installs
- 90,000+
- Known vulnerabilities
- 51 (6 without a fix)
- Data updated
- 2026-10-17 09:23 UTC
Check your version
This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.
No fix available (6)
The source lists no fixed version. Consider deactivating and replacing the plugin until a fix is released.
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| [en] BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. CVE-2026-53673 · Source | High | 8.1 | <= 14.4.0 | 2026-06-09 |
| BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data CVE-2026-1360 · Source | High | 7.5 | <= 14.5.0 | 2026-01-22 |
| [en] BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention nam CVE-2026-53674 · Source | High | 7.1 | <= 14.4.0 | 2026-06-09 |
| [en] WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. CVE-2020-37233 · Source | Medium | 6.4 | <= 6.2.0 | 2026-05-16 |
| BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion CVE-2024-12145 · Source | Medium | 4.3 | <= 14.3.3 | 2026-09-11 |
| [en] BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. CVE-2026-53675 · Source | Medium | 4.3 | <= 14.4.0 | 2026-06-09 |
Fixed in version 14.5.0 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| [en] The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages. CVE-2026-8155 · Source | Not rated | - | < 14.5.0 | 2026-07-31 |
Fixed in version 14.4.0 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin <= 14.3.4 is vulnerable to Broken Access Control CVE-2025-62022 · Source | High | 7.5 | < 14.4.0 | 2025-09-27 |
Fixed in version 14.3.4 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-11976 · Source | High | 7.3 | < 14.3.4 | 2026-01-22 |
Fixed in version 14.2.1 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal CVE-2024-10011 · Source | High | 8.1 | < 14.2.1 | 2024-10-24 |
Fixed in version 12.5.1 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-4892 · Source | Medium | 5.4 | < 12.5.1 | 2024-06-11 |
Fixed in version 12.4.1 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-3974 · Source | Medium | 5.4 | < 12.4.1 | 2024-05-03 |
Fixed in version 11.3.2 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-50880 · Source | Medium | 6.5 | < 11.3.2 | 2023-12-26 |
Fixed in version 9.1.1 (4)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 9.0.0 - SQL Injection No CVE assigned · Source | Not rated | - | < 9.1.1 | 2021-08-18 |
| BuddyPress <= 9.0.0 - Information Disclosure via REST API No CVE assigned · Source | Not rated | - | < 9.1.1 | 2021-08-18 |
| BuddyPress < 9.1.1 - Activation Key Disclosure No CVE assigned · Source | Not rated | - | < 9.1.1 | - |
| BuddyPress < 9.1.1 - SQL Injections No CVE assigned · Source | Not rated | - | < 9.1.1 | - |
Fixed in version 7.3.0 (5)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 7.2.1 - Missing Authorization to Group Creation No CVE assigned · Source | Not rated | - | < 7.3.0 | 2021-04-14 |
| BuddyPress <= 7.2.1 - Insufficient Privilege De-escalation No CVE assigned · Source | Not rated | - | < 7.3.0 | 2021-04-14 |
| BuddyPress <= 7.2.1 - Missing Authorization to Private Post Activity No CVE assigned · Source | Not rated | - | < 7.3.0 | 2021-04-14 |
| BuddyPress <= 7.2.1 - Missing Authorization to Unauthorized Group Access No CVE assigned · Source | Not rated | - | < 7.3.0 | 2021-04-14 |
| BuddyPress [buddypress] < 7.3.0 No CVE assigned · Source | Not rated | - | < 7.3.0 | - |
Fixed in version 7.2.1 (5)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 7.2.0 - Authorization Bypass to Friend Invite No CVE assigned · Source | Not rated | - | < 7.2.1 | 2021-03-17 |
| BuddyPress [buddypress] < 7.2.1 No CVE assigned · Source | Not rated | - | < 7.2.1 | - |
| BuddyPress [buddypress] < 7.2.1 No CVE assigned · Source | Not rated | - | < 7.2.1 | - |
| BuddyPress < 7.2.1 - Manage BuddyPress Member Types No CVE assigned · Source | Not rated | - | < 7.2.1 | - |
| BuddyPress [buddypress] < 7.2.1 No CVE assigned · Source | Not rated | - | < 7.2.1 | - |
Fixed in version 6.4.0 (3)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress plugin <= 6.3.0 - Excessive user capabilities in possible rich text fields vulnerability No CVE assigned · Source | Not rated | - | < 6.4.0 | 2020-11-29 |
| BuddyPress <= 6.3.0 - Insufficient Input Validation No CVE assigned · Source | Not rated | - | < 6.4.0 | 2020-11-27 |
| BuddyPress < 6.4.0 - Lack of Capability Check on Profile Page No CVE assigned · Source | Not rated | - | < 6.4.0 | - |
Fixed in version 5.1.2 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 5.1.1 - Sensitive Information Disclosure CVE-2020-5244 · Source | High | 7.5 | < 5.1.2 | 2020-01-02 |
Fixed in version 5.1.1 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress <= 5.1.0 - Denial of Service No CVE assigned · Source | Not rated | - | < 5.1.1 | 2019-12-23 |
| BuddyPress < 5.1.1 - Denial of Service No CVE assigned · Source | Not rated | - | < 5.1.1 | - |
Fixed in version 2.7.4 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin <= 2.7.3 - Arbitrary File Deletion No CVE assigned · Source | Not rated | - | < 2.7.4 | 2016-12-23 |
| BuddyPress 2.0 - 2.7.3 - Unauthenticated Arbitrary File Deletion No CVE assigned · Source | Not rated | - | < 2.7.4 | 2016-12-23 |
Fixed in version 2.3.5 (3)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin <= 2.3.4 - Privilege Escalation No CVE assigned · Source | Not rated | - | < 2.3.5 | 2015-11-12 |
| BuddyPress <= 2.3.4 - Privilege Escalation No CVE assigned · Source | Not rated | - | < 2.3.5 | 2015-11-11 |
| BuddyPress [buddypress] < 2.3.5 No CVE assigned · Source | Not rated | - | < 2.3.5 | - |
Fixed in version 1.9.2 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress Buddypress Plugin 1.9.1 - Privilege Escalation CVE-2014-1889 · Source | Medium | 6.5 | < 1.9.2 | 2014-02-05 |
| WordPress BuddyPress Plugin <= 1.9.1 - XSS CVE-2014-1888 · Source | Low | 0.0 | < 1.9.2 | 2014-02-07 |
Fixed in version 1.7.2 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin <= 1.7.1 - Multiple SQL Injections No CVE assigned · Source | Not rated | - | < 1.7.2 | 2015-05-15 |
| BuddyPress 1.7.1 - Multiple SQL Injections No CVE assigned · Source | Not rated | - | < 1.7.2 | - |
Fixed in version 1.5.5 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin 1.5.5 - Remote SQL Injection CVE-2012-2109 · Source | Low | 0.0 | < 1.5.5 | 2012-03-27 |
Fixed in version 1.2.10 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin <= 1.2.9 - SQL Injection No CVE assigned · Source | Not rated | - | < 1.2.10 | 2015-05-15 |
| BuddyPress [buddypress] < 1.2.10 No CVE assigned · Source | Not rated | - | < 1.2.10 | - |
Affects version 7.2.0 and earlier (3)
The source does not state the fixed version; versions after this one are not listed as affected.
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress plugin <= 7.2.0 - Privilege Escalation vulnerability CVE-2021-21389 · Source | High | 8.8 | >= 5.0.0 and <= 7.2.0 | 2021-03-16 |
| BuddyPress - 7.0.0 - 7.2.0 - Insufficient Privilege De-escalation No CVE assigned · Source | Not rated | - | >= 7.0.0 and <= 7.2.0 | 2021-03-16 |
| BuddyPress <= 7.2.0 - Authorization Bypass to Private Message Disclosure No CVE assigned · Source | Not rated | - | >= 5.0.0 and <= 7.2.0 | 2021-03-07 |
Affects version 5.1.1 and earlier (1)
The source does not state the fixed version; versions after this one are not listed as affected.
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress 5.0.0-5.1.1 - Private Data Exposure via REST API No CVE assigned · Source | Not rated | - | >= 5.0.0 and <= 5.1.1 | - |
Affects version 2.7.3 and earlier (1)
The source does not state the fixed version; versions after this one are not listed as affected.
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| BuddyPress 2.0-2.7.3 - Arbitrary File Deletion No CVE assigned · Source | Not rated | - | >= 2.0 and <= 2.7.3 | - |
Affects version 1.2.10 and earlier (1)
The source does not state the fixed version; versions after this one are not listed as affected.
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress BuddyPress Plugin 1.2.10 - HTML Injection Vulnerability No CVE assigned · Source | Not rated | - | <= 1.2.10 | 2011-09-26 |
Check every plugin on your site automatically
Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.
Sources and attribution
- Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
- CVE records are copyright The MITRE Corporation. CVE Terms of Use.
- Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
- Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.