907 matches found
BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution
WordPress BuddyPress before version 7.2.1 is susceptible to a privilege escalation vulnerability that can be leveraged to perform remote code execution. id: CVE-2021-21389 info: name: BuddyPress REST API 7.2.1 - Privilege Escalation/Remote Code Execution author: lotusdll severity: high descriptio...
CVE-2021-21389
CVE-2021-21389 BuddyPress 7.2.1 - REST API Privilege Escalation to RCE PoC Full Affected version: 5.0.0 to 7.2.0 User requirement: Subscriber user Method: Privilege Escalation to Administrator and trigger RCE via REST API Endpoint: /v1/members/me endpoint. How to use Docker git clone...
CVE-2025-31033
⚠️ CVE-2025-31033 - CSRF in WordPress Buddypress Humanity Plugin Exploit – CVE-2025-31033 form action="http://target.com/wp-admin/admin.php?page=bph-settings" me...
CVE-2021-21389
Usage 1. Build the vulnerable WordPress and BuddyPress environment using Docker. 2. Build and run the mariaDB container. 3. Ensure the two containers run on the same network. ex docker network create wordpressnetwork docker network connect wordpressnetwork wordpressapp docker network connect...
CVE-2026-116868
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types = 1.3.1 versions...
CVE-2026-116868 WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types = 1.3.1 versions...
EUVD-2026-112988
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types = 1.3.1 versions...
CVE-2026-116868
The BuddyPress Xprofile Custom Field Types plugin for WordPress, versions
CVE-2026-115965
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...
CVE-2026-115965 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...
CVE-2026-115965
The BuddyPress plugin for WordPress is vulnerable to Blind SQL Injection due to the improper neutralization of special elements used in SQL commands. This vulnerability affects BuddyPress versions from the earliest release through 14.5.2 . Exploitation could allow an attacker to interfere with th...
EUVD-2026-112730
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...
CVE-2026-111850
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...
CVE-2026-111850
The BuddyPress WordPress plugin (versions ≤ 14.5.2 ) is vulnerable to an SQL Injection flaw due to improper neutralization of special elements used in SQL commands. This vulnerability allows an attacker to interfere with database queries. While the specific vulnerable component or function is not...
EUVD-2026-112070
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...
CVE-2026-111850 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...
WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BuddyPress Xprofile Custom Field Types versions = 1.3.1...
PT-2026-128233
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...