WordPress security by component
BuddyPress
Plugin description
BuddyPress is a WordPress component with 15 published CVE records in this archive. The latest tracked vulnerability was published Jun 10, 2026; the highest CVE/CNA score is 8.6.
Plugin slug:
buddypressLatest vulnerability
CVE-2026-53675: BuddyPress: A security weakness
BuddyPress is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 14.4.0.
| Safe version |
|
||
|---|---|---|---|
| Jun 10, 2026 |
CVE-2026-53675
BuddyPress: A security weakness
BuddyPress is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 14.4.0.
|
> 14.4.0 |
CVE5.3
NVDPending
|
| Jun 10, 2026 |
CVE-2026-53674
BuddyPress: A security weakness
BuddyPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 14.4.0.
|
> 14.4.0 |
CVE7.1
NVDPending
|
| Jun 10, 2026 |
CVE-2026-53673
BuddyPress: A security weakness
BuddyPress is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 14.4.0.
|
> 14.4.0 |
CVE8.6
NVDPending
|
| May 16, 2026 |
CVE-2020-37233
Buddypress: Cross-site scripting
Buddypress is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is 6.2.0.
|
See mitigation notes |
CVE5.1
NVDPending
|
| Jan 23, 2026 |
CVE-2024-11976
The BuddyPress: A security weakness
The BuddyPress is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.3
NVDPending
|
| Oct 22, 2025 |
CVE-2025-62022
BuddyPress: A security weakness
BuddyPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Jan 22, 2025 |
CVE-2025-23798
Mass Messaging in BuddyPress: Cross-site scripting
Mass Messaging in BuddyPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Oct 25, 2024 |
CVE-2024-10011
BuddyPress: Filesystem traversal
BuddyPress is affected by filesystem traversal. Exploitation requires at least subscriber-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.1
NVD8.1
|
| Jun 12, 2024 |
CVE-2024-4892
BuddyPress: Cross-site scripting
BuddyPress is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 14, 2024 |
CVE-2024-3974
BuddyPress: Cross-site scripting
BuddyPress is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Dec 29, 2023 |
CVE-2023-50880
BuddyPress: Cross-site scripting
BuddyPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Mar 26, 2021 |
CVE-2021-21389
Buddypress: A security weakness
Buddypress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE8.1
NVD8.8
|
| Apr 10, 2018 |
CVE-2014-1889
Buddypress: A security weakness
Buddypress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD6.5
|
| Mar 01, 2014 |
CVE-2014-1888
Buddypress: Cross-site scripting
Buddypress is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| Sep 04, 2012 |
CVE-2012-2109
Buddypress: SQL injection
Buddypress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVD7.5
|