Vendor

    BuddyBoss

    18 known vulnerabilities in products by BuddyBoss, 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in BuddyBoss
    CriticalCVE-2026-56032

    WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability

    		9.8
    HighCVE-2026-76124

    BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

    		8.8
    HighCVE-2026-118082

    WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

    		8.8
    CriticalCVE-2025-1909

    BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider

    		9.8
    MediumCVE-2021-44692

    BuddyBoss: security vulnerability

    		5.3
    CriticalCVE-2023-32670

    BuddyBoss XSS vulnerability

    		9.0
    MediumCVE-2018-21014

    Buddyboss Buddymoss Media: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2023-45755

    WordPress BuddyPress Global Search Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

    		5.9
    MediumCVE-2021-43334

    BuddyBoss: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2024-13858

    Boss Media BuddyBoss Theme: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-13860

    Boss Media BuddyBoss Platform: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-13859

    Boss Media BuddyBoss Platform: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-4750

    BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment

    		5.3
    MediumCVE-2023-32671

    BuddyBoss XSS vulnerability

    		6.3
    MediumCVE-2024-13402

    Boss Media BuddyBoss Platform: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2023-32669

    Authorization Bypass on BuddyBoss

    		5.4
    MediumCVE-2024-4886

    BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR

    		4.3
    LowCVE-2024-12767

    BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR

    		3.5

    Products

    Products by BuddyBoss
    Boss Media BuddyBoss Platform90
    BuddyBoss60