BuddyBoss has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.8 (high).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 8.8
Publish → KEV: —
Last 90 days: 2 prev 0

Weakness classes

Products

BuddyBoss App 1
Buddyboss Platform 1

Follow BuddyBoss:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

BuddyBoss vulnerabilities

CVEs affecting BuddyBoss, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-76124High· 8.8

3d ago

BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-s…

▾ TwilightBuddyBoss · BuddyBoss AppEPSS 0.44%via CVEORG

CVE-2026-118082High· 8.8

1w ago

WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.

▾ TwilightBuddyBoss · Buddyboss PlatformEPSS 0.36%via CVEORG