WordPress plugin
BuddyPress security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High8
- Medium20
- Low0
All BuddyPress vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data ≤14.5.0No patch available | CVE-2026-1360 | |
| High7.3 | Unauthenticated Arbitrary Shortcode Execution ≤14.3.3Update to 14.3.4 | CVE-2024-11976 | |
| High8.1 | Authenticated (Subscriber+) Directory Traversal ≤14.1.0Update to 14.2.1 | CVE-2024-10011 | |
| Critical9.8 | SQL Injection ≤9.0.0Update to 9.1.1 | — | |
| High8.8 | Information Disclosure via REST API ≤9.0.0Update to 9.1.1 | — | |
| High8.8 | Insufficient Privilege De-escalation ≤7.2.1Update to 7.3.0 | — | |
| High8.8 | Privilege Escalation via REST API 5.0.0 – 7.2.0Update to 7.2.1 | CVE-2021-21389 | |
| High7.5 | Sensitive Information Disclosure ≤5.1.1Update to 5.1.2 | CVE-2020-5244 | |
| Critical10.0 | 2.7.3 - Unauthenticated Arbitrary File Deletion 2.0 – 2.7.3Update to 2.7.4 | — | |
| High8.8 | Privilege Escalation ≤2.3.4Update to 2.3.5 | — | |
| Critical9.8 | 1.5-1.5.4 - SQL Injection 1.5 – 1.5.4Update to 1.5.5 | CVE-2012-2109 |
- High7.5Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
≤14.5.0No patch available
- High7.3Unauthenticated Arbitrary Shortcode Execution
≤14.3.3Update to 14.3.4
- High8.1Authenticated (Subscriber+) Directory Traversal
≤14.1.0Update to 14.2.1
- Critical9.8SQL Injection
≤9.0.0Update to 9.1.1
- High8.8Information Disclosure via REST API
≤9.0.0Update to 9.1.1
- High8.8Insufficient Privilege De-escalation
≤7.2.1Update to 7.3.0
- High8.8Privilege Escalation via REST API
5.0.0 – 7.2.0Update to 7.2.1
- High7.5Sensitive Information Disclosure
≤5.1.1Update to 5.1.2
- Critical10.02.7.3 - Unauthenticated Arbitrary File Deletion
2.0 – 2.7.3Update to 2.7.4
- High8.8Privilege Escalation
≤2.3.4Update to 2.3.5
- Critical9.81.5-1.5.4 - SQL Injection
1.5 – 1.5.4Update to 1.5.5
BuddyPress: common questions
Does BuddyPress have known vulnerabilities?
Yes. VulnCrest Radar lists 31 known vulnerabilities in BuddyPress: 3 critical, 8 high, 20 medium. At least one is not fixed in the latest version.
How do I check which version of BuddyPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent BuddyPress vulnerability?
CVE-2026-115965, published Oct 27, 2026: BuddyPress <= 14.5.2 - Authenticated (Subscriber+) SQL Injection. Severity: Medium (CVSS 6.5).
Is any BuddyPress vulnerability listed in CISA KEV?
No. None of the known BuddyPress vulnerabilities is currently listed in the CISA KEV catalog.