PatchTheCVEbuddyboss vulnerabilities
Recent CVEs affecting buddyboss products. 5 tracked.
buddyboss has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2025-05-15. Highest priority: CVE-2024-13858 (score 28/100).
- CVE-2024-13860 MEDIUM 6.4 UPGRADE The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_ti
- CVE-2024-13859 MEDIUM 6.4 UPGRADE The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_a
- CVE-2024-13858 MEDIUM 6.4 UPGRADE The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting v
- CVE-2024-13402 MEDIUM 6.4 UPGRADE The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’
- CVE-2024-12767 LOW 3.5 UPGRADE The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user
FAQ
How do I fix buddyboss vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is buddyboss being exploited right now?
None of the tracked buddyboss CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which buddyboss CVE should I patch first?
CVE-2024-13858 currently ranks highest (28/100): The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting v.