CVE-2025-12391: Missing Authorization

The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoptinoptout function in all versions up to, and including, 1.5.2. This makes it possible for unauthenticated attackers to opt in and out of tracki...

PT-2024-33269

Name of the Vulnerable Software and Affected Versions BuddyPress plugin for WordPress versions up to, and including, 12.4.1 Description The issue is related to Stored Cross-Site Scripting via the display name parameter due to insufficient input sanitization and output escaping. This allows...