CVE-2024-12767

< 2.7.60

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on

3.5LOW

CVE-2025-1909

< 2.7.10

The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. T

9.8CRITICAL

CVE-2024-13860

<= 2.8.50

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter i

6.4MEDIUM

CVE-2024-13859

<= 2.8.50

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’

6.4MEDIUM

CVE-2024-13858

<= 2.8.50

The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_na

6.4MEDIUM

CVE-2024-13402

< 2.8.00

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all

6.4MEDIUM

CVE-2024-4886

< 2.6.00

The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request

4.3MEDIUM

CVE-2024-4750

< 2.6.0

The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by m

5.3MEDIUM

CVE-2023-45755

<= 1.2.1

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BuddyBoss BuddyPress Global Search plugin <= 1.2.1 versions.

5.9MEDIUM

CVE-2023-32671

all versions

A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to

6.3MEDIUM

CVE-2023-32670

all versions

Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to exe

9.0CRITICAL

CVE-2023-32669

all versions

Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to acce

5.4MEDIUM

CVE-2021-44692

<= 1.8.0

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it ge

5.3MEDIUM

CVE-2021-43334

<= 1.8.0

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.

5.4MEDIUM

CVE-2018-21014

<= 3.2.3

The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.

5.4MEDIUM