BuddyTask
BuddyTask has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for BuddyTask has a vendor fix available, so running the current release closes it.
All of these findings were reported by Itthidej Aramsri (Boeing777). BuddyTask is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-14064BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation
Read the full analysisVulnerability Records
BuddyTask
Author
Cytech
BuddyTask is a WordPress plugin that allows the members of a community to manage their tasks and workflows by using a KanBan like board. BuddyTask deeply integrates with BuddyPress (2.5+) and offers the following features: Ability to add a KanBan like board in Buddypress Groups where all the members of a group can organize their tasks Ability to add a KanBan like board in any Post or Page by simply using the [buddytask] shortcode Ability to assign tasks to specific group members or registered users Ability to break down a task into multiple sub-tasks or todos in order to better track their completion Ability for the users to prioritize the tasks and their sub-tasks by simply using drag and drop Integrates with the notification system of BuddyPress in order to notify the users about any changes in their assigned tasks. Automatic calculation and representation of the percentage of completion of each task Automatic sync of the board among all its users in the background, without the need to refresh the page This plugin is available in english.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C