BuddyBoss Platform

BuddyBoss Platform has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (40%). Other recurring categories include Authorization Bypass Through User-Controlled Key, SQL Injection.

Every one of the 10 issues recorded for BuddyBoss Platform has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (3) reported by Faris Krivic.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all BuddyBoss Platform vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-59514

BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

10 records


2026-07-09 00:00	BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection BuddyBoss Platform <= 3.0.5	`CVE-2026-59514`	7.5 High	VDsec	Yes
2026-06-23 00:00	BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection BuddyBoss Platform <= 3.0.4	`CVE-2026-56032`	7.5 High	dutafi	Yes
2025-05-01 00:00	BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' BuddyBoss Platform <= 2.8.50	`CVE-2024-13858`	6.4 Medium	Kaique Peres	Yes
2025-05-01 00:00	BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' BuddyBoss Platform <= 2.8.50	`CVE-2024-13860`	6.4 Medium	Kaique Peres	Yes
2025-05-01 00:00	BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function BuddyBoss Platform <= 2.8.50	`CVE-2024-13859`	6.4 Medium	Kaique Peres	Yes
2025-02-26 00:00	BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' BuddyBoss Platform <= 2.7.70	`CVE-2024-13402`	6.4 Medium	mikemyers	Yes
2025-01-14 00:00	BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure BuddyBoss Platform < 2.7.60	`CVE-2024-12767`	4.3 Medium	Faris Krivic	Yes
2024-05-15 00:00	Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post BuddyBoss Platform <= 2.5.91	`CVE-2024-4886`	4.3 Medium	Faris Krivic	Yes
2024-05-14 00:00	Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post BuddyBoss Platform <= 2.5.91	`CVE-2024-4750`	4.3 Medium	Faris Krivic	Yes
2021-09-16 00:00	Buddyboss Platform <= 1.7.8 - SQL Injection BuddyBoss Platform <= 1.7.8	`N/A`	7.2 High	Anonymous	Yes

Showing 1–10 of 10 reports