Buddyboss Theme Vulnerabilities

The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack...

CVSS:

6.4

Affected:

up to 2.8.41

Fixed in:

2.8.50

Disclosed:

May 1, 2025

CVE-2024-13858 on NVD →

The BuddyBoss Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.61. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can t...

CVSS:

4.3

Affected:

up to 2.4.61

Fixed in:

2.5.01

Disclosed:

Jul 9, 2024

CVE-2024-37925 on NVD →

Affected:

up to 2.5.01

Fixed in:

2.5.01

Disclosed:

Jul 9, 2024

CVE-2024-37925 on NVD →

The BuddyBoss Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unspecified function in all versions up to, and including, 2.4.60. This makes it possible for unauthenticated attackers to change the plugin's settings.

CVSS:

5.3

Affected:

up to 2.4.60

Fixed in:

2.4.61

Disclosed:

Dec 27, 2023

CVE-2023-51477 on NVD →

Affected:

up to 2.4.61

Fixed in:

2.4.61

Disclosed:

Dec 27, 2023

CVE-2023-51477 on NVD →