EUVD-2026-112999

Subscriber Privilege Escalation in Buddyboss Platform = 3.5.0 versions...

CVE-2026-118082

The Buddyboss Platform plugin for WordPress (versions

CVE-2026-102007 Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...

CVE-2026-102007 Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...

CVE-2026-102007

The Bit integrations plugin for WordPress (versions up to and including 2.10.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'field mapped to notification_content' parameter (e.g., payload_text). This flaw a...

EUVD-2026-98347

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...

PT-2026-111297

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification content attacker-chosen key, e.g. payload text' parameter in all versions up to, and including, 2.10....

CVE-2026-39771

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

EUVD-2026-93278

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

CVE-2026-39771 WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

CVE-2026-39771

The Buddyboss Platform WordPress plugin (versions

CVE-2026-39771 WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

PT-2026-106443

Name of the Vulnerable Software and Affected Versions Buddyboss Platform versions prior to 3.1.1 Description An issue exists that allows a user with subscriber privileges to perform a SQL Injection. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for...

CVE-2026-39771: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Buddyboss Platform versions = 3.1.0...

CVE-2026-93899

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899

The Better Messages plugin for WordPress (all versions up to and including 3.0.4 ) is vulnerable to a generic SQL Injection via the 'group_id' Message Meta Parameter. The root cause is insufficient escaping of the user-supplied parameter and a lack of sufficient preparation on the existing SQL qu...

EUVD-2026-86537

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...