BuddyBoss 2.2.9 for WordPress
Approved changes feed: RSS · Atom
cpe:2.3:a:buddyboss:buddyboss:2.2.9:*:*:*:*:wordpress:*:*
part: a version: 2.2.9 update: *
| Vendor | Buddyboss (21271bfe-19b3-5e6d-9041-882724c1152b) |
|---|---|
| Product | Buddyboss (3047aebf-3bbc-5023-b28c-2a7b2fa9b1b7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/buddyboss/buddyboss-platform |
purl2cpe | 2026-06-01 10:12:37.408800 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-32671 |
vulnerable | 2026-06-08 06:04:47.003260 |
BuddyBoss XSS vulnerability
MEDIUM (6.3)
A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation.
Published: 2023-10-03T12:26:44.072Z
Updated: 2024-09-06T14:09:55.335Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32670 |
vulnerable | 2026-06-08 06:04:47.002861 |
BuddyBoss XSS vulnerability
CRITICAL (9)
Cross-Site Scripting vulnerability
in BuddyBoss 2.2.9 version
, which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persistent javascript payload that would be triggered when the associated image is loaded.
Published: 2023-10-03T12:25:05.203Z
Updated: 2024-09-19T19:51:45.995Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32669 |
vulnerable | 2026-06-08 06:04:47.002345 |
Authorization Bypass on BuddyBoss
MEDIUM (5.4)
Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).
Published: 2023-10-03T12:23:24.533Z
Updated: 2024-09-06T14:10:21.920Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.