Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
BuddybossBuddyboss Platform*

7 matches found

CVE
CVE•added 2025/05/05 8:15 p.m.•63 views

CVE-2025-1909

The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthentic...

9.8CVSS8.9AI score0.00502EPSS
CVE
CVE•added 2024/06/05 6:15 a.m.•49 views

CVE-2024-4886

The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request

4.3CVSS4.8AI score0.00202EPSS
CVE
CVE•added 2025/05/02 7:15 a.m.•48 views

CVE-2024-13859

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Su...

6.4CVSS5.8AI score0.00039EPSS
CVE
CVE•added 2025/05/02 7:15 a.m.•48 views

CVE-2024-13860

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-l...

6.4CVSS5.8AI score0.00039EPSS
CVE
CVE•added 2025/05/02 7:15 a.m.•44 views

CVE-2024-13858

The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.5AI score0.00041EPSS
CVE
CVE•added 2025/02/27 1:15 p.m.•28 views

CVE-2024-13402

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level ...

6.4CVSS5.8AI score0.00022EPSS
CVE
CVE•added 2025/05/15 8:15 p.m.•16 views

CVE-2024-12767

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

7.5CVSS6.8AI score0.00061EPSS