https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-12767.htmlhttps://patchthecve.com/cve/CVE-2024-12767.htmlWed, 17 Jun 2026 07:00:26 +0000LOW 3.5: The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private postshttps://patchthecve.com/cve/CVE-2024-13860.htmlhttps://patchthecve.com/cve/CVE-2024-13860.htmlWed, 17 Jun 2026 07:02:51 +0000MEDIUM 6.4: The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-lehttps://patchthecve.com/cve/CVE-2024-13859.htmlhttps://patchthecve.com/cve/CVE-2024-13859.htmlWed, 17 Jun 2026 07:02:51 +0000MEDIUM 6.4: The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subhttps://patchthecve.com/cve/CVE-2024-13858.htmlhttps://patchthecve.com/cve/CVE-2024-13858.htmlWed, 17 Jun 2026 07:02:51 +0000MEDIUM 6.4: The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitization and output escaping. This makes it possible for https://patchthecve.com/cve/CVE-2024-13402.htmlhttps://patchthecve.com/cve/CVE-2024-13402.htmlWed, 17 Jun 2026 07:01:56 +0000MEDIUM 6.4: The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level ahttps://patchthecve.com/cve/CVE-2024-4886.htmlhttps://patchthecve.com/cve/CVE-2024-4886.htmlWed, 17 Jun 2026 08:03:06 +0000MEDIUM 4.3: The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request