WordPress security by component
Buddyboss Platform
Plugin description
Buddyboss Platform adds social networking, member profiles, groups, forums, and community features to WordPress.
Buddyboss Platform (buddyboss-platform) is a WordPress plugin with 10 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 9.8.
Plugin slug:
buddyboss-platformLatest vulnerability
CVE-2026-118082: Buddyboss Platform: Privilege escalation or authentication bypass
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is n/a through 3.5.0.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-118082
Buddyboss Platform: Privilege escalation or authentication bypass
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is n/a through 3.5.0.
|
See mitigation notes |
CVE8.8
|
| Oct 06, 2026 |
CVE-2026-39771
Buddyboss Platform: SQL injection
The export requires the Subscriber role or higher. Attacker-controlled input can change database-query semantics and expose database contents. The vulnerable query, endpoint and parameter are undisclosed. The supplied vector reports high confidentiality impact, limited availability impact. The vector requires no victim interaction. Affected versions: <= 3.1.0. No fixed release is confirmed. The current official release could not be verified.
|
See mitigation notes |
CVE8.5
|
| Jul 23, 2026 |
CVE-2026-59514
Buddyboss Platform: SQL injection
Buddyboss Platform is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.0.5.
|
3.1.0 |
CVE9.3
|
| Jun 26, 2026 |
CVE-2026-56032
Buddyboss Platform: Code execution
Buddyboss Platform is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 3.0.4.
|
3.0.5 |
CVE9.8
|
| May 15, 2025 |
CVE-2024-12767
buddyboss-platform: A security weakness
buddyboss-platform is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE3.5
|
| May 05, 2025 |
CVE-2025-1909
BuddyBoss Platform Pro: Privilege escalation or authentication bypass
BuddyBoss Platform Pro is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE9.8
|
| May 02, 2025 |
CVE-2024-13860
Buddyboss Platform: Cross-site scripting
Buddyboss Platform is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
|
| May 02, 2025 |
CVE-2024-13859
Buddyboss Platform: Cross-site scripting
Buddyboss Platform is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
|
| May 02, 2025 |
CVE-2024-13858
BuddyBoss Platform plugin and BuddyBoss: Cross-site scripting
BuddyBoss Platform plugin and BuddyBoss is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
|
| Feb 27, 2025 |
CVE-2024-13402
Buddyboss Platform: Cross-site scripting
Buddyboss Platform is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
|