What’s Vulnerable › Products

Boss Media BuddyBoss Platform vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your Boss Media BuddyBoss Platform version is affected

Latest Boss Media BuddyBoss Platform vulnerabilities

• CVE-2026-118082 — WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability (CVSS 8.8)
• CVE-2026-56032 — WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability (CVSS 9.8)
• CVE-2024-12767 — BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR (CVSS 3.5)
• CVE-2025-1909 — BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider (CVSS 9.8)
• CVE-2024-13860 — BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' (CVSS 5.4)
• CVE-2024-13859 — BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function (CVSS 5.4)
• CVE-2024-13858 — BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' (CVSS 5.4)
• CVE-2024-13402 — BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' (CVSS 5.4)
• CVE-2024-4886 — BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR (CVSS 4.3)