Threat Entry Updated 2026-01-26

CVE-2024-11976 - The Buddypress Plugin

The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

PLUGIN The Buddypress

CVE-2024-11976

HIGH CVSS 7.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-06

CVE-2024-10011 - Buddypress Plugin

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows.

PLUGIN Buddypress

CVE-2024-10011

HIGH CVSS 8.1 2024-10-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-05

CVE-2024-4892 - Buddypress Plugin

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Buddypress

CVE-2024-4892

MEDIUM CVSS 6.4 2024-06-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-05

CVE-2024-3974 - Buddypress Plugin

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Buddypress

CVE-2024-3974

MEDIUM CVSS 6.4 2024-05-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-21389 - Buddypress Plugin

BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

PLUGIN Buddypress

CVE-2021-21389

HIGH CVSS 8.1 2021-03-26

Risk Score

Open Full Technical Breakdown