Buddyboss

Buddyboss Platform

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
3.5

CVE-2024-12767

Exploit
  • EPSS 0.05%
  • Veröffentlicht 15.05.2025 20:15:37
  • Zuletzt bearbeitet 13.11.2025 21:15:46

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

9.8

CVE-2025-1909

  • EPSS 1.03%
  • Veröffentlicht 05.05.2025 19:42:25
  • Zuletzt bearbeitet 28.05.2025 20:03:54

The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through t...

5.4

CVE-2024-13859

  • EPSS 0.12%
  • Veröffentlicht 02.05.2025 06:41:51
  • Zuletzt bearbeitet 09.05.2025 18:16:02

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes...

5.4

CVE-2024-13858

  • EPSS 0.15%
  • Veröffentlicht 02.05.2025 06:41:50
  • Zuletzt bearbeitet 22.05.2025 20:15:26

The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitizatio...

5.4

CVE-2024-13860

  • EPSS 0.12%
  • Veröffentlicht 02.05.2025 06:41:50
  • Zuletzt bearbeitet 09.05.2025 18:16:02

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possib...

5.4

CVE-2024-13402

  • EPSS 0.08%
  • Veröffentlicht 27.02.2025 13:15:09
  • Zuletzt bearbeitet 24.05.2025 01:24:50

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible fo...

4.3

CVE-2024-4886

Exploit
  • EPSS 0.16%
  • Veröffentlicht 05.06.2024 06:15:12
  • Zuletzt bearbeitet 27.03.2025 21:15:50

The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request

5.3

CVE-2024-4750

Exploit
  • EPSS 0.31%
  • Veröffentlicht 04.06.2024 06:15:11
  • Zuletzt bearbeitet 30.06.2025 18:22:12

The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included in the request