Veille CVE

Recherche « Unknown BuddyPress »

4 CVE

Critique 0 Élevée 1 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown BuddyPress » ✕
  1. CVE-2026-88927 4.3 Moyenne

    Unknown rtMedia for WordPress, BuddyPress and bbPress

    The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.

  2. CVE-2026-87764 8.8 Élevée

    Unknown BuddyPress Instant Chat

    The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.

  3. CVE-2026-88912 4.2 Moyenne

    Unknown rtMedia for WordPress, BuddyPress and bbPress

    The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

  4. CVE-2026-8155 5.4 Moyenne

    Unknown BuddyPress

    The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.