WordPress Wbcom Designs – BuddyPress Group Reviews plugin <= 2.8.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Group Reviews plugin versions = 2.8.0. Solution Update the WordPress Wbcom Designs – BuddyPress Group Reviews plugin to the latest available version at least...

WordPress Wbcom Designs – Private Community for BuddyPress plugin <= 1.6.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – Private Community for BuddyPress plugin versions = 1.6.0. Solution Update the WordPress Wbcom Designs – Private Community for BuddyPress plugin to the latest available...

WordPress Wbcom BuddyPress Check-ins Pro premium plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom BuddyPress Check-ins Pro premium plugin versions = 1.3.0. Solution Update the WordPress Wbcom BuddyPress Check-ins Pro premium plugin to the latest available version at least 1.4....

WordPress Wbcom Designs – BuddyPress Ads plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Ads plugin versions = 1.3.0. Solution Update the WordPress Wbcom Designs – BuddyPress Ads plugin to the latest available version at least 1.3.1...

WordPress Wbcom Designs – BuddyPress Activity Filter plugin <= 2.7.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Activity Filter plugin versions = 2.7.0. Solution Update the WordPress Wbcom Designs – BuddyPress Activity Filter plugin to the latest available version at...

WordPress Wbcom BuddyPress Sticky Post premium plugin <= 1.9.7 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress BuddyPress Sticky Post premium plugin versions = 1.9.7. Solution Update the WordPress BuddyPress Sticky Post premium plugin to the latest available version at least 1.9.9...

WordPress "Block, Suspend, Report for BuddyPress" plugin < 3.3.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Block, Suspend, Report for BuddyPress" plugin versions 3.3.3. Solution Update the WordPress "Block, Suspend, Report for BuddyPress" plugin to the latest available version at least 3.3.3...

WordPress WooBuddy -> WooCommerce BuddyPress Integration plugin <= 3.4.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WooBuddy - WooCommerce BuddyPress Integration plugin versions WooCommerce BuddyPress Integration plugin to the latest available version at least 3.4.2...

WordPress WooBuddy -> WooCommerce BuddyPress Integration plugin <= 3.4.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooBuddy - WooCommerce BuddyPress Integration plugin versions WooCommerce BuddyPress Integration plugin to the latest available version at least 3.4.2...

WordPress "Block, Suspend, Report for BuddyPress" plugin < 3.3.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "Block, Suspend, Report for BuddyPress" plugin versions 3.3.3. Solution Update the WordPress "Block, Suspend, Report for BuddyPress" plugin to the latest available version at least 3.3.3...

Privilege Escalation

buddypress is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation allowing a user to be able to log in with administrator role...

GHSA-M6J4-8R7P-WPP3 BuddyPress privilege escalation via REST API

Impact It's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the BuddyPress REST API members endpoint. Patches The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitiga...

BuddyPress privilege escalation via REST API

Impact It's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the BuddyPress REST API members endpoint. Patches The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitiga...

BuddyPress < 9.1.1 - SQL Injections

The plugin was affected by SQL Injections via the BPNotificationsNotification::getorderbysql and BPInvitation::getorderbysql functions...

BuddyPress < 9.1.1 - Activation Key Disclosure

The plugin disclosed the activation key from responses of the createitem method in the BP REST API Signup controller...

CVE-2021-24443

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the...

WordPress BuddyPress Plugin Privilege Escalation (CVE-2021-21389)

A privilege escalation vulnerability exists in WordPress BuddyPress Plugin. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...

BuddyPress Customer.io Analytics Integration <= 1.1.6 - Arbitrary Plugin Settings Update via CSRF

The plugin does not properly perform the CSRF check when saving its settings, allowing attackers to make logged in admin change them to arbitrary values...

BuddyPress Customer.io Analytics Integration <= 1.1.6 - Arbitrary Plugin Settings Update via CSRF

The plugin does not properly perform the CSRF check when saving its settings, allowing attackers to make logged in admin change them to arbitrary values PoC...

WordPress BuddyPress Customer.io Analytics Integration plugin <= 1.1.6 - Arbitrary Plugin Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Plugin Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress BuddyPress Customer.io Analytics Integration plugin versions = 1.1.6. Solution Deactivate and delete. This plugin has been closed as of June 26, 2018 and is not available for...