Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?FriendsPawFriends - Pet Shop and VeterinaryCross-site scripting (XSS) vulnerability in the BuddyPressTwitter Friends WidgetTop FriendsFriendStore for WooCommerceSend to a Friend Addonthe friends REST API that
Plugin · buddypress
the friends REST API that
14 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 28, 2026BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111850 · affects up to 14.5.2 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
Sep 11, 2026BuddyPress: Insecure Direct Object ReferenceCVE-2024-12145 · affects up to 14.3.3 · reported by WordfenceMedium 4.3
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.
Jul 31, 2026BuddyPress: Does not properly enforce authorization on its private messaging endpointsCVE-2026-8155 · fixed in 14.5.0 · reported by WPScanMedium 5.4
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Jul 30, 2026BuddyPress: Deserialization of Untrusted DataCVE-2026-1360 · affects up to 14.5.0 · reported by WordfenceHigh 7.5
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.
Jun 9, 2026the friends REST API that: BuddyPress 14.4.0 contains an insecure direct object referenceCVE-2026-53675 · reported by VulnCheckMedium 5.3
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary user_id because the get_items_permissions_check method only verifies that the requester is logged in and never checks ownership of the requested list, resulting in disclosure of users' private social connections.
Jun 9, 2026the activity mention resolver that, when username compatibility mode is enabled,: BuddyPress 14.4.0 contains a regular expression injectionCVE-2026-53674 · reported by VulnCheckHigh 7.1
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.
Jun 9, 2026the messages REST API that: BuddyPress 14.4.0 contains an insecure direct object referenceCVE-2026-53673 · reported by VulnCheckHigh 8.6
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
May 16, 2026WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to injeCVE-2020-37233 · reported by VulnCheckMedium 5.1
WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers like onload that execute when administrators or privileged users preview or view the affected page content, enabling session hijacking and persistent phishing attacks.
Jan 23, 2026The BuddyPress: Arbitrary shortcode executionCVE-2024-11976 · affects up to 14.3.3 · reported by WordfenceHigh 7.3
The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2025BuddyPress: Missing AuthorizationCVE-2025-62022 · affects up to 14.3.4 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4.
Oct 25, 2024BuddyPress: Directory TraversalCVE-2024-10011 · affects up to 14.1.0 · reported by WordfenceHigh 8.1
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions.
Jun 11, 2024BuddyPress: Stored Cross-Site ScriptingCVE-2024-4892 · affects up to 12.4.1 · reported by WordfenceMedium 6.4
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2024BuddyPress: Stored Cross-Site ScriptingCVE-2024-3974 · affects up to 12.4.0 · reported by WordfenceMedium 6.4
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 29, 2023BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50880 · affects up to 11.3.1 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.