# BuddyPress

> Get together safely, in your own way, in WordPress.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:29 UTC.

## Facts (WordPress.org)

- Slug: `buddypress`
- Author: BuddyPress
- Version: 14.5.4
- Active installs: 90,000+
- Last update: 2026-10-23 (22 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.1, PHP 5.6
- Tags: community, group, members, network, self hosted
- Page: https://wordpress.org/plugins/buddypress/

## Checks (against WordPress 7.1.4)

- OK: Updated 22 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Locked in ↔ Portable, Slow ↔ Responsive, Steep ↔ Easy, Vague docs ↔ Clear docs, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-10-29 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 14.5.2). CVE-2026-115965, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0301aa6-bfbd-4b68-bf4c-e69878df57cf?source=api-prod
- 2026-10-28 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 14.5.2). CVE-2026-111850, https://www.wordfence.com/threat-intel/vulnerabilities/id/405d5ed4-c328-41c9-9ddf-a8128d03d76d?source=api-prod
- 2026-09-11 MEDIUM: Insecure Direct Object Reference to Notifications Deletion (up to 14.3.3). CVE-2024-12145, https://www.wordfence.com/threat-intel/vulnerabilities/id/8c2965c0-a07f-46a2-b06c-fa2e739aea94?source=api-prod
- 2026-07-31 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure (up to 14.4.0). CVE-2026-8155, https://www.wordfence.com/threat-intel/vulnerabilities/id/70b472f4-3a2d-4378-8b30-42859ec6ac39?source=api-prod
- 2026-07-30 HIGH: Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data (up to 14.5.0). CVE-2026-1360, https://www.wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c?source=api-prod
- 2026-06-09 MEDIUM: Authenticated (Custom+) Insecure Direct Object Reference (up to 14.4.0). CVE-2026-53675, https://www.wordfence.com/threat-intel/vulnerabilities/id/2b78e4fc-fbae-49c2-9328-e138c17fca91?source=api-prod
- 2026-06-09 MEDIUM: Authenticated (Custom+) Insecure Direct Object Reference (up to 14.4.0). CVE-2026-53673, https://www.wordfence.com/threat-intel/vulnerabilities/id/33056eeb-31b0-4f17-b892-808fce147068?source=api-prod
- 2026-01-22 HIGH: Unauthenticated Arbitrary Shortcode Execution (up to 14.3.3). CVE-2024-11976, https://www.wordfence.com/threat-intel/vulnerabilities/id/34c627c1-7838-468e-acb7-eb84ad1b4949?source=api-prod
- 2025-09-27 MEDIUM: Missing Authorization (up to 14.3.4). CVE-2025-62022, https://www.wordfence.com/threat-intel/vulnerabilities/id/f0077624-c111-468f-ae24-d730642b676c?source=api-prod
- 2024-10-24 HIGH: Authenticated (Subscriber+) Directory Traversal (up to 14.1.0). CVE-2024-10011, https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=api-prod
- 2024-06-11 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 12.5.0). CVE-2024-4892, https://www.wordfence.com/threat-intel/vulnerabilities/id/113c154d-94a0-41da-a5ed-d9b2617e1c2c?source=api-prod
- 2024-05-03 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 12.4.0). CVE-2024-3974, https://www.wordfence.com/threat-intel/vulnerabilities/id/3657384e-025a-44ad-8b7e-1a2fea17dcc3?source=api-prod
- 2023-12-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 11.3.1). CVE-2023-50880, https://www.wordfence.com/threat-intel/vulnerabilities/id/b824cab6-d340-487d-90ba-5b554db1da14?source=api-prod
- 2021-08-18 CRITICAL: SQL Injection (up to 9.0.0). WF-40765cfe-a60a-44dc-8cdb-f9c8e42654c3, https://www.wordfence.com/threat-intel/vulnerabilities/id/40765cfe-a60a-44dc-8cdb-f9c8e42654c3?source=api-prod
- 2021-08-18 HIGH: Information Disclosure via REST API (up to 9.0.0). WF-87b26fcf-d0b3-4ab3-92d8-8f1ba72af0a3, https://www.wordfence.com/threat-intel/vulnerabilities/id/87b26fcf-d0b3-4ab3-92d8-8f1ba72af0a3?source=api-prod
- 2021-04-14 MEDIUM: Missing Authorization to Group Creation (up to 7.2.1). WF-15b4b132-1e27-454d-9ba0-9d1a552e1844, https://www.wordfence.com/threat-intel/vulnerabilities/id/15b4b132-1e27-454d-9ba0-9d1a552e1844?source=api-prod
- 2021-04-14 HIGH:  Insufficient Privilege De-escalation (up to 7.2.1). WF-3166549e-b52e-41e8-8b5c-1a1a0558c858, https://www.wordfence.com/threat-intel/vulnerabilities/id/3166549e-b52e-41e8-8b5c-1a1a0558c858?source=api-prod
- 2021-04-14 MEDIUM: Missing Authorization to Private Post Activity (up to 7.2.1). WF-402bbe9c-cf4d-457c-97ac-149e14ea6f47, https://www.wordfence.com/threat-intel/vulnerabilities/id/402bbe9c-cf4d-457c-97ac-149e14ea6f47?source=api-prod
- 2021-04-14 MEDIUM: Missing Authorization to Unauthorized Group Access (up to 7.2.1). WF-d0ca9780-8918-40ff-80c0-62ce483adbae, https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ca9780-8918-40ff-80c0-62ce483adbae?source=api-prod
- 2021-03-17 MEDIUM: Authorization Bypass to Friend Invite (up to 7.2.0). WF-04601634-d707-44a7-9b5f-46c4b9687469, https://www.wordfence.com/threat-intel/vulnerabilities/id/04601634-d707-44a7-9b5f-46c4b9687469?source=api-prod
- 2021-03-16 MEDIUM: Insufficient Privilege De-escalation (7.0.0 to 7.2.1 (excl.)). WF-5d7bcd71-e299-47fe-a749-e72c49b8129e, https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7bcd71-e299-47fe-a749-e72c49b8129e?source=api-prod
- 2021-03-16 HIGH: Privilege Escalation via REST API (5.0.0 to 7.2.0). CVE-2021-21389, https://www.wordfence.com/threat-intel/vulnerabilities/id/c3da10da-8de3-4547-abe4-202002728c80?source=api-prod
- 2021-03-07 MEDIUM: Authorization Bypass to Private Message Disclosure (up to 7.2.0). WF-001a7d43-4b00-42e9-bb0c-94a9d5721166, https://www.wordfence.com/threat-intel/vulnerabilities/id/001a7d43-4b00-42e9-bb0c-94a9d5721166?source=api-prod
- 2020-11-27 MEDIUM: Insufficient Input Validation (before 6.4.0). WF-4bd169bc-1538-400f-b2cd-0bbcf1fea7ee, https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd169bc-1538-400f-b2cd-0bbcf1fea7ee?source=api-prod
- 2020-01-02 HIGH: Sensitive Information Disclosure (up to 5.1.1). CVE-2020-5244, https://www.wordfence.com/threat-intel/vulnerabilities/id/8457c5e1-9c31-4a1a-a221-36647753a877?source=api-prod
- 2019-12-23 MEDIUM: Denial of Service (up to 5.1.0). WF-ed5cf097-1b27-4d20-b7b2-2aa909bce042, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5cf097-1b27-4d20-b7b2-2aa909bce042?source=api-prod
- 2016-12-23 CRITICAL: Unauthenticated Arbitrary File Deletion (2.0 to 2.7.3). WF-5a3e2d1c-8879-4def-8861-3d6d8b683b7e, https://www.wordfence.com/threat-intel/vulnerabilities/id/5a3e2d1c-8879-4def-8861-3d6d8b683b7e?source=api-prod
- 2015-11-11 HIGH: Privilege Escalation (up to 2.3.4). WF-9bed2e86-1cc0-4fed-a44f-0c495c423e22, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bed2e86-1cc0-4fed-a44f-0c495c423e22?source=api-prod
- 2014-08-01 MEDIUM: Stored Cross-Site Scripting (up to 1.9.1). CVE-2014-1888, https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fe3724-f71c-4548-9410-838c0337f887?source=api-prod
- 2014-02-05 MEDIUM: Authorization Bypass (before 1.9.2). CVE-2014-1889, https://www.wordfence.com/threat-intel/vulnerabilities/id/cd85da97-f62c-4c4e-ae29-dea5aa529f54?source=api-prod
- 2012-03-27 CRITICAL: 1.5-1.5.4 - SQL Injection (1.5 to 1.5.4). CVE-2012-2109, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4cc739-0563-4ca2-931d-818a0c285257?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=buddypress · HTML: https://todaywp.com/plugins/buddypress