Skip to content
Noroxi

BuddyBoss records

15 published records for vendor BuddyBoss.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
33.3%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 19
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

15 records
  • CVE-2025-1909
    39Monitor

    BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider

    CriticalCVSS 9.8No exploitEPSS 0%

    buddyboss · buddyboss platformMay 5, 2025

  • CVE-2021-44692
    21Monitor

    BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user.

    MediumCVSS 5.3No exploitEPSS 1%

    buddyboss · buddybossJan 26, 2022

  • CVE-2018-21014
    21Monitor

    The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddymoss mediaSep 9, 2019

  • CVE-2021-43334
    21Monitor

    BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddybossJan 26, 2022

  • CVE-2024-4750
    21Monitor

    BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment

    MediumCVSS 5.3No exploitEPSS 0%

    buddyboss · buddybossJun 4, 2024

  • CVE-2023-32670
    21Monitor

    BuddyBoss XSS vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddybossOct 3, 2023

  • CVE-2023-32671
    21Monitor

    BuddyBoss XSS vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddybossOct 3, 2023

  • CVE-2023-32669
    21Monitor

    Authorization Bypass on BuddyBoss

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddybossOct 3, 2023

  • CVE-2024-13858
    21Monitor

    BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddyboss platformMay 2, 2025

  • CVE-2024-13859
    21Monitor

    BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddyboss platformMay 2, 2025

  • CVE-2024-13860
    21Monitor

    BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddyboss platformMay 2, 2025

  • CVE-2024-13402
    21Monitor

    BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

    MediumCVSS 5.4No exploitEPSS 0%

    buddyboss · buddyboss platformFeb 27, 2025

  • CVE-2023-45755
    19Monitor

    WordPress BuddyPress Global Search Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 4.8No exploitEPSS 0%

    buddyboss · buddypress global searchOct 25, 2023

  • CVE-2024-4886
    17Monitor

    BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR

    MediumCVSS 4.3No exploitEPSS 0%

    buddyboss · buddyboss platformJun 5, 2024

  • CVE-2024-12767
    14Monitor

    BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR

    LowCVSS 3.5No exploitEPSS 0%

    buddyboss · buddyboss platformMay 15, 2025