WordPress plugin
BuddyPress security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High8
- Medium20
- Low0
All BuddyPress vulnerabilities
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤14.5.2Update to 14.5.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤14.5.2Update to 14.5.3
- Medium4.3Insecure Direct Object Reference to Notifications Deletion
≤14.3.3Update to 14.3.4
- High7.5Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
≤14.5.0No patch available
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
≤14.4.0Update to 14.5.0
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference
≤14.4.0No patch available
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference
≤14.4.0No patch available
- High7.3Unauthenticated Arbitrary Shortcode Execution
≤14.3.3Update to 14.3.4
- Medium5.3Missing Authorization
≤14.3.4Update to 14.4.0
- High8.1Authenticated (Subscriber+) Directory Traversal
≤14.1.0Update to 14.2.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤12.5.0Update to 12.5.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤12.4.0Update to 12.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.3.1Update to 11.3.2
- Critical9.8SQL Injection
≤9.0.0Update to 9.1.1
- High8.8Information Disclosure via REST API
≤9.0.0Update to 9.1.1
- High8.8Insufficient Privilege De-escalation
≤7.2.1Update to 7.3.0
- Medium5.4Missing Authorization to Private Post Activity
≤7.2.1Update to 7.3.0
- Medium5.4Missing Authorization to Unauthorized Group Access
≤7.2.1Update to 7.3.0
- Medium5.4Missing Authorization to Group Creation
≤7.2.1Update to 7.3.0
- Medium5.4Authorization Bypass to Friend Invite
≤7.2.0Update to 7.2.1
- Medium4.67.0.0 - 7.2.0 - Insufficient Privilege De-escalation
7.0.0 – <7.2.1Update to 7.2.1
- High8.8Privilege Escalation via REST API
5.0.0 – 7.2.0Update to 7.2.1
- Medium6.5Authorization Bypass to Private Message Disclosure
≤7.2.0Update to 7.2.1
- Medium6.4Insufficient Input Validation
<6.4.0Update to 6.4.0
- High7.5Sensitive Information Disclosure
≤5.1.1Update to 5.1.2
- Medium5.4Denial of Service
≤5.1.0Update to 5.1.1
- Critical10.02.7.3 - Unauthenticated Arbitrary File Deletion
2.0 – 2.7.3Update to 2.7.4
- High8.8Privilege Escalation
≤2.3.4Update to 2.3.5
- Medium6.4Stored Cross-Site Scripting
≤1.9.1Update to 1.9.2
- Medium6.5Authorization Bypass
<1.9.2Update to 1.9.2
- Critical9.81.5-1.5.4 - SQL Injection
1.5 – 1.5.4Update to 1.5.5
BuddyPress: common questions
Does BuddyPress have known vulnerabilities?
Yes. VulnCrest Radar lists 31 known vulnerabilities in BuddyPress: 3 critical, 8 high, 20 medium. At least one is not fixed in the latest version.
How do I check which version of BuddyPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent BuddyPress vulnerability?
CVE-2026-115965, published Oct 27, 2026: BuddyPress <= 14.5.2 - Authenticated (Subscriber+) SQL Injection. Severity: Medium (CVSS 6.5).
Is any BuddyPress vulnerability listed in CISA KEV?
No. None of the known BuddyPress vulnerabilities is currently listed in the CISA KEV catalog.