CVE-2026-115965

WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress-extensions

Products

Buddypress Buddypress

CVE-2018-25308

BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion

BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Donmik Wordpress

Products

Buddypress Buddypress Xprofile Custom Fields Type Wordpress

CVE-2024-12145

BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2026-8155

BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2026-1360

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2026-53673

BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2026-53674

BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2026-53675

BuddyPress 14.4.0 Friends List IDOR via REST API

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary user_id because the get_items_permissions_check method only verifies that the requester is logged in and never checks ownership of the requested list, resulting in disclosure of users' private social connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2023-50880

WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress

Products

Buddypress

CVE-2025-62760

WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode bp-activity-shortcode allows Stored XSS.This issue affects BuddyPress Activity Shortcode: from n/a through <= 1.1.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2025-62022

WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2025-58263

WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Notification Widget buddypress-notifications-widget allows Stored XSS.This issue affects BuddyPress Notification Widget: from n/a through <= 1.3.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2025-48158

WordPress BuddyPress XProfile Custom Image Field Plugin <= 3.0.1 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field allows Path Traversal.This issue affects BuddyPress XProfile Custom Image Field: from n/a through <= 3.0.1.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2025-23798

WordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows Reflected XSS.This issue affects Mass Messaging in BuddyPress: from n/a through <= 2.2.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Buddypress

Products

Buddypress

CVE-2025-12391

Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update

The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_optout() function in all versions up to, and including, 1.5.2. This makes it possible for unauthenticated attackers to opt in and out of tracking.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress Seventhqueen Wordpress

Products

Buddypress Restrictions For Buddypress Wordpress

CVE-2025-9218

rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Bbpress Buddypress Rtcamp and 1 more

Products

Bbpress Buddypress Rtmedia and 1 more

CVE-2024-11976

BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution

The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress

Products

Buddypress Wordpress

CVE-2024-3974

BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress

Products

Buddypress

CVE-2024-10011

BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Buddypress

Products

Buddypress

CVE-2024-4892

BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Buddypress

Products

Buddypress