68 matches found
CVE-2025-3793
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...
CVE-2025-3793 Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...
CVE-2025-3793 Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...
PT-2025-17720 · WordPress · Buddypress Force Password Change
Name of the Vulnerable Software and Affected Versions: Buddypress Force Password Change plugin for WordPress versions up to, and including, 0.1 Description: The issue allows for authenticated account takeover due to improper validation of a user's identity prior to updating their password through...
CVE-2025-1780 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.25. This makes it possible for authenticated...
CVE-2024-13358 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.24. This makes it possible for authenticated...
CVE-2024-10011
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended...
CVE-2024-11913
The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajaxpreviewlink' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web...
CVE-2024-11913
CVE-2024-11913 affects the WordPress plugin Activity Plus Reloaded for BuddyPress, with Blind SSRF via ajax_preview_link in all versions up to 1.1.1. Reported by Wordfence; authenticated attackers with Subscriber+ can induce web requests from the app to internal or arbitrary locations, potentiall...
CVE-2025-23798
CVE-2025-23798 affects the WordPress Mass Messaging in BuddyPress plugin (versions n/a through 2.2.1). The vulnerability is a Reflected Cross-Site Scripting (XSS) due to improper neutralization of inputs during web page generation. Connected sources confirm the affected product and versions, and ...
CVE-2025-23706 WordPress Jet Skinner for BuddyPress plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddypress allows Reflected XSS.This issue affects Jet Skinner for BuddyPress: from n/a through = 1.2.5...
CVE-2024-10011
CVE-2024-10011 (BuddyPress
CVE-2024-4892 BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘displayname’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissio...
CVE-2024-3974 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions...
WordPress BuddyPress Plugin <= 12.4.0 is vulnerable to Cross Site Scripting (XSS)
Software BuddyPress Type Plugin Vulnerable versions = 12.4.0 Fixed in 12.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3974 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c936264fa18b Credits wesley wcraft Require...
CVE-2022-45074
Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...
CVE-2022-45074 WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...
CVE-2022-45074
CVE-2022-45074 refers to a CSRF vulnerability in the WordPress Activity Reactions for Buddypress plugin (versions
PT-2023-14586 · WordPress · Activity Reactions For Buddypress
Name of the Vulnerable Software and Affected Versions: Activity Reactions For Buddypress plugin versions = 1.0.22 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...