Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: BuddyBoss Component: Buddyboss Platform Clear all filters
TI-2024-11831 CVE-2024-12767 · GHSA-c6wh-53mq-4gr9

BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR

Priority MEDIUM 50

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00343 Published 2025-05-15 Fixed in 2.7.60 CWE-639
TI-2024-12880 CVE-2024-13859 · GHSA-jwhw-fx3f-p3m6

Cross-site scripting in BuddyBoss Platform

Priority LOW 28

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient input sanitization a…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00282 Published 2025-05-02 No fix listed CWE-79
TI-2024-12881 CVE-2024-13860 · GHSA-3qjj-xgvq-44qh

BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'

Priority LOW 28

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00282 Published 2025-05-02 No fix listed CWE-79
TI-2024-12879 CVE-2024-13858 · GHSA-qqrc-c2h6-m823

Cross-site scripting in BuddyBoss Theme

Priority LOW 28

The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00306 Published 2025-05-02 No fix listed CWE-79
TI-2024-12444 CVE-2024-13402 · GHSA-xcgh-pcrh-mfp2

BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

Priority LOW 28

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00239 Published 2025-02-27 No fix listed CWE-79