Vulnerabilities > Buddyboss
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2025-05-02 | CVE-2024-13858 | Cross-site Scripting vulnerability in Buddyboss Platform The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. | 5.4 |
| 2025-05-02 | CVE-2024-13859 | Cross-site Scripting vulnerability in Buddyboss Platform The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. | 5.4 |
| 2025-05-02 | CVE-2024-13860 | Cross-site Scripting vulnerability in Buddyboss Platform The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. | 5.4 |
| 2024-06-05 | CVE-2024-4886 | Authorization Bypass Through User-Controlled Key vulnerability in Buddyboss Platform The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request | 4.3 |
| 2023-10-25 | CVE-2023-45755 | Unspecified vulnerability in Buddyboss Buddypress Global Search 1.2.1 Auth. | 4.8 |
| 2023-10-03 | CVE-2023-32669 | Authorization Bypass Through User-Controlled Key vulnerability in Buddyboss 2.2.9 Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. | 5.4 |
| 2023-10-03 | CVE-2023-32670 | Cross-site Scripting vulnerability in Buddyboss 2.2.9 Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persistent javascript payload that would be triggered when the associated image is loaded. | 5.4 |
| 2023-10-03 | CVE-2023-32671 | Cross-site Scripting vulnerability in Buddyboss 2.2.9 A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. | 5.4 |
| 2022-01-26 | CVE-2021-43334 | Cross-site Scripting vulnerability in Buddyboss BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field. | 5.4 |
| 2022-01-26 | CVE-2021-44692 | Information Exposure vulnerability in Buddyboss BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. | 5.3 |