Vulnerabilities

TI-2026-04490 CVE-2026-5144 · GHSA-mxm6-xwqw-p92f

BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR

MEDIUM 40

The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00422 Published 2026-04-11 No fix listed CWE-269

TI-2025-04966 CVE-2025-5526 · GHSA-h646-fcwc-rq3q

BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

MEDIUM 53

The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00263 Published 2025-06-27 Fixed in 2.2.5

TI-2024-08543 CVE-2024-9207 · GHSA-rpm2-gj54-rqvf

BuddyPress Docs <= 2.2.3 - Reflected Cross-Site Scripting

LOW 27

The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00383 Published 2024-10-08 No fix listed CWE-79

Vulnerabilities

Filters

BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR

BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

BuddyPress Docs <= 2.2.3 - Reflected Cross-Site Scripting