Buddypress
Approved changes feed: RSS · Atom
cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Buddypress (4d6eba7e-a91f-5f4e-8d48-aa07a4f64a97) |
|---|---|
| Product | Buddypress (fbb4d772-93db-58b5-b625-994763470925) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/buddypress/buddypress |
purl2cpe | 2026-06-01 10:16:39.427403 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111850 |
vulnerable | 2026-11-03 10:16:10.853021 |
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
HIGH (8.5)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
Published: 2026-10-28T13:00:27.940Z
Updated: 2026-10-29T13:47:38.415Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115965 |
vulnerable | 2026-11-03 10:15:37.219308 |
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
HIGH (8.5)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
Published: 2026-10-29T11:00:24.136Z
Updated: 2026-10-29T12:36:52.568Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12145 |
vulnerable | 2026-09-16 04:46:37.012712 |
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
MEDIUM (4.3)
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.
Published: 2026-09-11T11:28:52.377Z
Updated: 2026-09-11T20:19:12.097Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1360 |
vulnerable | 2026-09-16 04:33:42.090062 |
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
HIGH (7.5)
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.
Published: 2026-07-30T04:03:14.202Z
Updated: 2026-07-30T14:03:13.114Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-53675 |
vulnerable | 2026-07-29 01:00:27.156093 |
BuddyPress 14.4.0 Friends List IDOR via REST API
MEDIUM (4.3)
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary user_id because the get_items_permissions_check method only verifies that the requester is logged in and never checks ownership of the requested list, resulting in disclosure of users' private social connections.
Published: 2026-06-09T23:44:22.188Z
Updated: 2026-10-08T15:23:08.724Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-53674 |
vulnerable | 2026-07-29 01:00:27.155786 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-53673 |
vulnerable | 2026-07-29 01:00:27.154338 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62022 |
vulnerable | 2026-06-08 07:37:28.546316 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4892 |
vulnerable | 2026-06-08 06:50:18.969110 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3974 |
vulnerable | 2026-06-08 06:43:52.017496 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11976 |
vulnerable | 2026-06-08 06:23:50.793386 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10011 |
vulnerable | 2026-06-08 06:22:03.355884 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21389 |
vulnerable | 2026-06-08 05:29:11.802764 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5244 |
vulnerable | 2026-06-08 05:26:41.580211 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-6954 |
vulnerable | 2026-06-08 05:09:55.190559 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-1888 |
vulnerable | 2026-06-08 05:05:26.689410 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.