Read the docs

BuddyBoss

Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

BuddyBoss records in CISA KEV

No BuddyBoss vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Buddyboss Platform 7 records MEDIUM Buddyboss 6 records MEDIUM Buddymoss Media 1 record LOW Buddypress Global Search 1 record LOW

Records

20 records

TI-2024-11831 CVE-2024-12767 · GHSA-c6wh-53mq-4gr9

BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR

Priority MEDIUM 50

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00343 Published 2025-05-15 Fixed in 2.7.60 CWE-639
TI-2023-15946 CVE-2023-32670 · GHSA-qxv7-7h44-6g5h

BuddyBoss XSS vulnerability

Priority MEDIUM 41

Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persi…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00423 Published 2023-10-03 No fix listed CWE-79
TI-2026-84232 CVE-2026-76124 · GHSA-qj2m-6jmm-rjxw

Arbitrary file upload in BuddyBoss App WordPress plugin

Priority MEDIUM 40

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00437 Published 2026-11-03 No fix listed CWE-434
TI-2026-83531 CVE-2026-96554 · GHSA-fjfj-gq95-wvgm

Stored Cross-Site Scripting via Group Name in BuddyBoss Platform

Priority LOW 28

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00199 Published 2026-10-31 No fix listed CWE-79
TI-2024-12881 CVE-2024-13860 · GHSA-3qjj-xgvq-44qh

BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'

Priority LOW 28

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00282 Published 2025-05-02 No fix listed CWE-79
TI-2024-12880 CVE-2024-13859 · GHSA-jwhw-fx3f-p3m6

Cross-site scripting in BuddyBoss Platform

Priority LOW 28

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient input sanitization a…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00282 Published 2025-05-02 No fix listed CWE-79
TI-2024-12879 CVE-2024-13858 · GHSA-qqrc-c2h6-m823

Cross-site scripting in BuddyBoss Theme

Priority LOW 28

The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00306 Published 2025-05-02 No fix listed CWE-79
TI-2024-12444 CVE-2024-13402 · GHSA-xcgh-pcrh-mfp2

BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

Priority LOW 28

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00239 Published 2025-02-27 No fix listed CWE-79
TI-2023-15947 CVE-2023-32671 · GHSA-7c55-fjfv-79jq

BuddyBoss XSS vulnerability

Priority LOW 28

A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00366 Published 2023-10-03 No fix listed CWE-79
TI-2023-15945 CVE-2023-32669 · GHSA-r73q-v29w-vr75

Authorization Bypass on BuddyBoss

Priority LOW 24

Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00358 Published 2023-10-03 No fix listed CWE-639
Open these records in search →