BuddyPress vulnerabilities

CVEs whose affected-version data names the BuddyPress package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2024-12145Medium· 4.3

1w ago

BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes…

▾ Sunlitbuddypress · BuddyPressEPSS 0.20%via CVEORG