BuddyPress vulnerabilities
We track 7 vulnerabilities in BuddyPress products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest BuddyPress vulnerabilities
- 8.5 High severity
BuddyPress: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
- 8.5 High severity
BuddyPress: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
- 7.5 High severity
BuddyPress: Deserialization of Untrusted Data
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on u
- 7.1 High severity
BuddyPress: Improper Neutralization of Special Elements in Data Query Logic
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metac
- 8.1 High severity
BuddyPress: Authorization Bypass Through User-Controlled Key
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another us
- 7.3 High severity
BuddyPress: Improper Control of Generation of Code
The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_short
- 8.1 High severity
BuddyPress: Improper Limitation of a Pathname to a Restricted Directory
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files