BuddyPress.org

BuddyPress 14.5.0, 12.7.0, and 11.6.0 are now available. These are security and maintenance releases that include two security fixes, along with a number of compatibility improvements, bug fixes, and code modernization updates. We strongly recommend updating your sites as soon as possible. Highlights Prevent user ID spoofing in the Messages REST API endpoint via improved […]

BuddyPress 14.2.1 is now available. This is a maintenance & security release. All BuddyPress installations should be updated as soon as possible. The 14.2.1 release addresses the following security issue: The “Take Photo” feature (which uses the logged in user’s Webcam to capture their profile photo) was vulnerable to an authenticated (Subscriber+) directory traversal. Discovered […]

BuddyPress 12.5.1 is now available. This is a security release. All BuddyPress installations should be updated as soon as possible. The 12.5.1 release addresses the following security issue: The Members block was vulnerable to a Stored Cross-Site Scripting. Discovered by Wesley (wcraft) from the Wordfence organization. This vulnerability was impacting BuddyPress branches from 9.0 to 12.0. […]

BuddyPress 12.4.1 is now available. This is a security release. All BuddyPress installations should be updated as soon as possible. The 12.4.1 release addresses the following security issue: The dynamic Members, dynamic Friends & dynamic Groups blocks were vulnerable to a Stored Cross-Site Scripting. Discovered by Wesley (wcraft) from the Wordfence organization. This vulnerability was impacting […]

BuddyPress 11.3.2 is now available. This is a security release. All BuddyPress installations should be updated as soon as possible. The 11.3.2 release addresses the following security issue: A Potential Cross Site Scripting using Members/Groups block props by a user having a contributor role vulnerability. Discovered by Rafie Muhammad (Patchstack). This vulnerability was reported privately to […]

BuddyPress 11.3.1 is now available. This is a security and maintenance release. All BuddyPress installations should be updated as soon as possible. The 11.3.1 release addresses the following security issue: A blind SQL Injection from unauthenticated users vulnerability was fixed in BP_XProfile_Query->find_compatible_table_alias(). Discovered by Michael Mazzolini. This vulnerability was reported privately to the BuddyPress team, in […]

BuddyPress 9.1.1 is now available. This is a security and maintenance release. All BuddyPress installations are strongly encouraged to upgrade as soon as possible. The 9.1.1 release addresses three security issues: The activation key was included into the responses of the create_item method of BP REST API Signup controller. Discovered by Brajesh Singh. An SQL Injection […]

BuddyPress 7.3.0 is now available. This is a security and maintenance release. All BuddyPress installations are strongly encouraged to upgrade as soon as possible. The 7.3.0 release addresses four security issues: A vulnerability was fixed that could allow a member to create a group on behalf of another member via a REST API endpoint. A vulnerability […]

BuddyPress 7.2.1 is now available. This is a security release. All BuddyPress installations are strongly encouraged to upgrade as soon as possible. The 7.2.1 release addresses 5 security issues which were reported privately to the BuddyPress team by Kien Hoang, in accordance with WordPress’s security policies: A vulnerability was fixed that could allow a privilege escalation from […]

BuddyPress 6.4.0 is now available. This is a security and maintenance release. All BuddyPress installations are strongly encouraged to upgrade as soon as possible. The 6.4.0 release addresses one security issue: non-capable users could add a style attributes to “span” and “p” elements in possible rich text fields of their profile page. The vulnerability has been […]