Known vulnerabilities in BuddyPress

Get together safely, in your own way, in WordPress.

27Reported vulnerabilities

10Highest CVSS score

14.5.2Latest version

90,000+Active installs

What to do now

Update BuddyPress to 14.5.0 or later. 25 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 29, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2014-1889	Medium 6.5	10.6%	Before 1.9.2	`1.9.2`	April 10, 2018
CVE-2021-21389	High 8.8	13.5%	5.0.0 up to (but not including) 7.2.1	`7.2.1`	March 26, 2021
CVE-2012-2109	Critical 9.8	3.4%	1.5 to 1.5.4 (inclusive)	`1.5.5`	March 27, 2012
WF-5a3e2d1c-8879-4def-8861-3d6d8b683b7e	Critical 10	—	2.0 to 2.7.3 (inclusive)	`2.7.4`	December 23, 2016
WF-40765cfe-a60a-44dc-8cdb-f9c8e42654c3	Critical 9.8	—	9.0.0 and earlier	`9.1.1`	August 18, 2021
WF-87b26fcf-d0b3-4ab3-92d8-8f1ba72af0a3	High 8.8	—	9.0.0 and earlier	`9.1.1`	August 18, 2021
WF-3166549e-b52e-41e8-8b5c-1a1a0558c858	High 8.8	—	7.2.1 and earlier	`7.3.0`	April 14, 2021
WF-9bed2e86-1cc0-4fed-a44f-0c495c423e22	High 8.8	—	2.3.4 and earlier	`2.3.5`	November 11, 2015
CVE-2024-10011	High 8.1	0.9%	14.1.0 and earlier	`14.2.1`	October 25, 2024
CVE-2020-5244	High 7.5	2.4%	5.1.1 and earlier	`5.1.2`	January 2, 2020
CVE-2026-1360	High 7.5	0.6%	0 to 14.5.0 (inclusive)	—	July 30, 2026
CVE-2024-11976	High 7.3	0.5%	0 to 14.3.3 (inclusive)	`14.3.4`	January 23, 2026
CVE-2014-1888	Medium 6.4	2.6%	1.9.1 and earlier	`1.9.2`	August 1, 2014
CVE-2023-50880	Medium 6.4	0.4%	11.3.1 and earlier	`11.3.2`	December 26, 2023
WF-001a7d43-4b00-42e9-bb0c-94a9d5721166	Medium 6.5	—	7.2.0 and earlier	`7.2.1`	March 7, 2021
WF-4bd169bc-1538-400f-b2cd-0bbcf1fea7ee	Medium 6.4	—	Before 6.4.0	`6.4.0`	November 27, 2020
CVE-2024-4892	Medium 5.4	0.4%	Before 12.5.1	`12.5.1`	June 12, 2024
CVE-2024-3974	Medium 5.4	0.4%	Before 12.4.1	`12.4.1`	May 14, 2024
CVE-2025-62022	Medium 5.3	0.4%	14.3.4 and earlier	`14.4.0`	September 27, 2025
WF-15b4b132-1e27-454d-9ba0-9d1a552e1844	Medium 5.4	—	7.2.1 and earlier	`7.3.0`	April 14, 2021
WF-402bbe9c-cf4d-457c-97ac-149e14ea6f47	Medium 5.4	—	7.2.1 and earlier	`7.3.0`	April 14, 2021
WF-d0ca9780-8918-40ff-80c0-62ce483adbae	Medium 5.4	—	7.2.1 and earlier	`7.3.0`	April 14, 2021
WF-04601634-d707-44a7-9b5f-46c4b9687469	Medium 5.4	—	7.2.0 and earlier	`7.2.1`	March 17, 2021
WF-ed5cf097-1b27-4d20-b7b2-2aa909bce042	Medium 5.4	—	5.1.0 and earlier	`5.1.1`	December 23, 2019
CVE-2020-37233	Medium 5.1	0.2%	—	—	May 16, 2026
WF-5d7bcd71-e299-47fe-a749-e72c49b8129e	Medium 4.6	—	7.0.0 up to (but not including) 7.2.1	`7.2.1`	March 16, 2021
CVE-2026-8155	Medium 4.3	0.1%	14.4.0 and earlier	`14.5.0`	July 13, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.