High
CVE-2026-89301
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 146
Reset filters
High
CVE-2026-39780
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-88912
rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-16482
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
Medium
CVE-2024-12145
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
Medium
CVE-2026-81275
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-81279
Push Notification for Post and BuddyPress <= 3.20 - Missing Authorization
High
CVE-2026-66592
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection
High
CVE-2026-73397
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-1360
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
High
CVE-2026-59549
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Unauthenticated SQL Injection
Medium
CVE-2026-59551
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-8155
BuddyPress <= 14.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
Medium
CVE-2026-13450
GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
Medium
CVE-2026-4653
Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter
Medium
CVE-2026-40773
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 - Missing Authorization
Medium
CVE-2026-1559
Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
High
CVE-2026-5144
BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR
High
CVE-2026-25464
Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.4 - Unauthenticated Local File Inclusion
High
CVE-2026-22443
Alliance <= 3.1.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25325
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure
Medium
CVE-2025-69296
Aardvark <= 4.6.3 - Reflected Cross-Site Scripting
High
CVE-2024-11976
BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2025-14997
BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.