buddyboss_platform vulnerabilities

CVEs whose affected-version data names the buddyboss_platform package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-96554Medium· 6.4

6d ago

BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for au…

▾ SunlitBoss Media · BuddyBoss PlatformEPSS 0.20%via CVEORG