Plugin security history

BuddyBoss Platform Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 10 vulnerability records associated with BuddyBoss Platform, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

10Total records

0Critical

3High

7Medium

0Low

0Informational

10Patched records

0Currently marked unpatched

2021-09-16First disclosure

2026-07-09Latest disclosure

9 of 10CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2024	2	2 records
2025	5	5 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
High	3	30%
Medium	7	70%

Vulnerability-Type Breakdown

Cross-Site Scripting

4 records40%

First: 2025. Latest: 2025.

Missing Authorization

3 records30%

First: 2024. Latest: 2025.

SQL Injection

2 records20%

First: 2021. Latest: 2026.

Other

1 record10%

First: 2026. Latest: 2026.

Patch Status

Patched: 10
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.1.0
3.0.5
2.8.51
2.8.00
2.7.60
2.6.0
1.7.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.0.5`	BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection	July 9, 2026	3.1.0	High
`*-3.0.4`	BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection	June 23, 2026	3.0.5	High
`*-2.8.50`	BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function	May 1, 2025	2.8.51	Medium
`*-2.8.50`	BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'	May 1, 2025	2.8.51	Medium
`*-2.8.50`	BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'	May 1, 2025	2.8.51	Medium
`*-2.7.70`	BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'	February 26, 2025	2.8.00	Medium
`[*, 2.7.60)`	BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure	January 14, 2025	2.7.60	Medium
`*-2.5.91`	Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post	May 15, 2024	2.6.0	Medium
`*-2.5.91`	Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post	May 14, 2024	2.6.0	Medium
`*-1.7.8`	Buddyboss Platform <= 1.7.8 - SQL Injection	September 16, 2021	1.7.9	High

Selected source records

Latest Records

HighCVE-2026-59514

BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection

Published: July 9, 2026

Affected versions: *-3.0.5
Patched versions: 3.1.0

Original Wordfence record

HighCVE-2026-56032

BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection

Published: June 23, 2026

Affected versions: *-3.0.4
Patched versions: 3.0.5

Original Wordfence record

MediumCVE-2024-13858

BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'

Published: May 1, 2025

Affected versions: *-2.8.50
Patched versions: 2.8.51

Affected versions: *-2.8.41
Patched versions: 2.8.50

Original Wordfence record

MediumCVE-2024-13860

BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'

Published: May 1, 2025

Affected versions: *-2.8.50
Patched versions: 2.8.51

Original Wordfence record

MediumCVE-2024-13859

BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function

Published: May 1, 2025

Affected versions: *-2.8.50
Patched versions: 2.8.51

Original Wordfence record

MediumCVE-2024-13402

BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

Published: February 26, 2025

Affected versions: *-2.7.70
Patched versions: 2.8.00

Original Wordfence record

MediumCVE-2024-12767

BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure

Published: January 14, 2025

Affected versions: [*, 2.7.60)
Patched versions: 2.7.60

Original Wordfence record

MediumCVE-2024-4886

Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post

Published: May 15, 2024

Affected versions: *-2.5.91
Patched versions: 2.6.0

Original Wordfence record

Highest-Severity Records

HighCVE-2026-56032

BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection

Published: June 23, 2026

Affected versions: *-3.0.4
Patched versions: 3.0.5

Original Wordfence record

HighCVE-2026-59514

BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection

Published: July 9, 2026

Affected versions: *-3.0.5
Patched versions: 3.1.0

Original Wordfence record

High

Buddyboss Platform <= 1.7.8 - SQL Injection

Published: September 16, 2021

Affected versions: *-1.7.8
Patched versions: 1.7.9

Original Wordfence record

MediumCVE-2024-13402

BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

Published: February 26, 2025

Affected versions: *-2.7.70
Patched versions: 2.8.00

Original Wordfence record

MediumCVE-2024-13858

BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'

Published: May 1, 2025

Affected versions: *-2.8.50
Patched versions: 2.8.51

Affected versions: *-2.8.41
Patched versions: 2.8.50

Original Wordfence record

MediumCVE-2024-13860

BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'

Published: May 1, 2025

Affected versions: *-2.8.50
Patched versions: 2.8.51

Original Wordfence record

MediumCVE-2024-13859

BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function

Published: May 1, 2025

Affected versions: *-2.8.50
Patched versions: 2.8.51

Original Wordfence record

MediumCVE-2024-4750

Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post

Published: May 14, 2024

Affected versions: *-2.5.91
Patched versions: 2.6.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory