CVE Tools
Track your stack

Buddypress

2 CVEs tracked since 2012. Since Sep 2012, none of them reached CISA KEV.

Buddypress CVEs per month

Sep 2012 to Feb 2014. Point at a month, or focus the strip and use the arrow keys.
Buddypress CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2012-0910
2012-10null or fewer
2012-11null or fewer
2012-12null or fewer
2013-01null or fewer
2013-02null or fewer
2013-03null or fewer
2013-04null or fewer
2013-05null or fewer
2013-06null or fewer
2013-07null or fewer
2013-08null or fewer
2013-09null or fewer
2013-10null or fewer
2013-11null or fewer
2013-12null or fewer
2014-01null or fewer
2014-0210

Products

The products that kept showing up in Buddypress's monthly top three, with their CVEs summed over those months.

  1. Buddypress22 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Buddypress.

  1. CVE-2024-12145BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion4.3
  2. CVE-2026-1360BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data7.5
  3. CVE-2026-53675BuddyPress 14.4.0 Friends List IDOR via REST API4.3
  4. CVE-2026-53674BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution7.1
  5. CVE-2026-53673BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter8.1
  6. CVE-2024-11976BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution7.3
  7. CVE-2025-62022WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability7.5
  8. CVE-2025-23798WordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1
  9. CVE-2024-10011BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal8.1
  10. CVE-2024-4892BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4
  11. CVE-2024-3974BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4
  12. CVE-2023-50880WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)6.5
  13. CVE-2021-21389BuddyPress privilege escalation via REST API8.1
  14. CVE-2020-5244Private data exposure via REST API in BuddyPress8.0
  15. CVE-2014-1889The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.6.5

The record

Peak rank
#88 in Feb 2014
Busiest month shown
Sep 2012, 1 CVEs
Months with a KEV entry
0 since Sep 2012
Monthly snapshots
2 since 2012
Buddypress's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store