682 matches found
BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution
WordPress BuddyPress before version 7.2.1 is susceptible to a privilege escalation vulnerability that can be leveraged to perform remote code execution. id: CVE-2021-21389 info: name: BuddyPress REST API 7.2.1 - Privilege Escalation/Remote Code Execution author: lotusdll severity: high descriptio...
CVE-2026-66592
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...
EUVD-2026-63335
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...
CVE-2026-66592
An unauthenticated SQL injection vulnerability affects the rtMedia plugin for WordPress, BuddyPress, and bbPress at versions 4.7.11 and below. With a CVSS 3.1 base score of 9.3 (Critical), it allows remote attackers with no credentials to execute arbitrary SQL queries, potentially exposing sensit...
CVE-2026-8155
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user Subscriber+ to read, modify, or delete other users' private messages...
CVE-2026-8155 BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user Subscriber+ to read, modify, or delete other users' private messages...
CVE-2026-8155
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user Subscriber+ to read, modify, or delete other users' private messages...
EUVD-2026-51429
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user Subscriber+ to read, modify, or delete other users' private messages...
CVE-2026-8155
The issue affects the WooCommerce BuddyPress WordPress plugin? No—the affected product is the BuddyPress WordPress plugin (WordPress) prior to version 14.5.0. The root cause is improper authorization enforcement on private messaging endpoints, allowing any authenticated user (Subscriber+) to read...
CVE-2026-1360
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...
EUVD-2026-50968
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...
CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...
CVE-2026-1360
BuddyPress for WordPress up to 14.5.0 is affected by a Deserialization of Untrusted Data flaw in bp_unserialize_profile_field(), which calls unserialize() without the allowed_classes parameter on user-controlled XProfile field data. This allows an authenticated attacker (subscriber level or highe...
CVE-2026-59551
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59549
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
EUVD-2026-49220
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59551 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59551
The CVE-2026-59551 entry concerns the WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions up to 4.7.10). The issue is a SQL Injection vulnerability in subscriber handling within this plugin. Public details in the provided documents specify affected software and the underlying...
CVE-2026-59551
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59549
Affected software: WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.10). Vulnerability: Unauthenticated SQL Injection. Root cause/impact: SQL injection that does not require authentication; CVSS metrics in the external record indicate high confidentiality impact ...