PatchTheCVEbuddyboss platform vulnerabilities and fixes
Recent CVEs affecting buddyboss platform, with upgrade or downgrade steps. 6 tracked.
Also searched as: buddybossplatform.
buddyboss platform has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-05-15. Highest priority: CVE-2024-4886 (score 28/100).
- CVE-2024-4886 MEDIUM 4.3 UPGRADE The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID inc
- CVE-2024-13860 MEDIUM 6.4 UPGRADE The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_ti
- CVE-2024-13859 MEDIUM 6.4 UPGRADE The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_a
- CVE-2024-13858 MEDIUM 6.4 UPGRADE The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting v
- CVE-2024-13402 MEDIUM 6.4 UPGRADE The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’
- CVE-2024-12767 LOW 3.5 UPGRADE The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user
FAQ
How do I fix buddyboss platform vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is buddyboss platform being exploited right now?
None of the tracked buddyboss platform CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which buddyboss platform CVE should I patch first?
CVE-2024-4886 currently ranks highest (28/100): The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID inc.