boonebgorges vulnerabilities

Products

• BuddyPress Docs 2
• BuddyPress Groupblog 1

Latest boonebgorges CVEs

Newest publication first

1. CVE-2026-5144 BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR

   Published 2026-04-11

   High·CVSS 8.8 EPSS 0.42%

   The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3. This is due to the group blog settings handler accepting the groupblog-blogid, default-member, and groupblog-silent-add parameters from user input with...

2. CVE-2025-5526 BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

   Published 2025-06-27

   Medium·CVSS 4.3 EPSS 0.26%

   The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user

3. CVE-2024-9207 BuddyPress Docs <= 2.2.3 - Reflected Cross-Site Scripting

   Published 2024-10-08

   Medium·CVSS 6.1 EPSS 0.38%

   The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to inject arbitrar...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.