BuddyBoss vulnerabilities
We track 3 vulnerabilities in BuddyBoss products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest BuddyBoss vulnerabilities
- 8.8 High severity
BuddyBoss App: Unrestricted Upload of File with Dangerous Type
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type he
- 9.3 Critical severity
Buddyboss Platform: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyBoss Buddyboss Platform buddyboss-platform allows Blind SQL Injection.This issue affects Buddyboss Platform: from n/a through 3.0.5.
- 9.8 Critical severity
BuddyBoss Platform Pro: Authentication Bypass Using an Alternate Path or Channel
The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin.