BuddyBoss Platform

BuddyBoss Platform has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; 10 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (36%). Other recurring categories include Authorization Bypass Through User-Controlled Key, SQL Injection.

10 of the records (91%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

5 independent researchers contributed these findings, most of them (3) reported by Faris Krivic.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage91%

Open

Fixed

Get automatic notifications for all BuddyBoss Platform vulnerabilities before they are exploited.

Most severe open issueCVSS 6.5CVE-2026-39771

BuddyBoss Platform <= 3.1.0 - Authenticated (Subscriber+) SQL Injection

Read the full analysis

Vulnerability Records

11 records


2026-10-05 00:00	BuddyBoss Platform <= 3.1.0 - Authenticated (Subscriber+) SQL Injection BuddyBoss Platform <= 3.1.0	`CVE-2026-39771`	6.5 Medium	dutafi	No
2026-07-09 00:00	BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection BuddyBoss Platform <= 3.0.5	`CVE-2026-59514`	7.5 High	VDsec	Yes
2026-06-23 00:00	BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection BuddyBoss Platform <= 3.0.4	`CVE-2026-56032`	7.5 High	dutafi	Yes
2025-05-01 00:00	BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' BuddyBoss Platform <= 2.8.50	`CVE-2024-13858`	6.4 Medium	Kaique Peres	Yes
2025-05-01 00:00	BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' BuddyBoss Platform <= 2.8.50	`CVE-2024-13860`	6.4 Medium	Kaique Peres	Yes
2025-05-01 00:00	BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function BuddyBoss Platform <= 2.8.50	`CVE-2024-13859`	6.4 Medium	Kaique Peres	Yes
2025-02-26 00:00	BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' BuddyBoss Platform <= 2.7.70	`CVE-2024-13402`	6.4 Medium	Michael Mazzolini	Yes
2025-01-14 00:00	BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure BuddyBoss Platform < 2.7.60	`CVE-2024-12767`	4.3 Medium	Faris Krivic	Yes
2024-05-15 00:00	Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post BuddyBoss Platform <= 2.5.91	`CVE-2024-4886`	4.3 Medium	Faris Krivic	Yes
2024-05-14 00:00	Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post BuddyBoss Platform <= 2.5.91	`CVE-2024-4750`	4.3 Medium	Faris Krivic	Yes

Showing 1–10 of 11 reports