These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-87764 BuddyPress Instant Chat WordPress plugin vulnerability allows unauthenticated users to store arbitrary web scripts in conversations, potentially leading to XSS attacks against users who view those conversations later. The plugin through version 1.6 fails to validate chat message senders and does not properly escape message content before outputting it back, enabling the storage of malicious [truncated]
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference, allowing authenticated attackers with Subscriber-level access and above to delete/mark as read/mark as unread notifications of other users. This vulnerability requires verification of BuddyPress plugin versions and user access controls. Affected WordPress administrators and users should assess their exposure and take de [truncated]
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages. This issue has a CVSS score of 5.4 and is classified as MEDIUM severity. The vulnerability is characterized by CWE-639, indicating improper authorization. This could lead to unauthor [truncated]
CVE-2026-53674 is a HIGH severity vulnerability in BuddyPress 14.4.0. The vulnerability exists in the activity mention resolver when username compatibility mode is enabled. Attackers can craft @mentions containing regex metacharacters, which pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table. This allows for boolean-based inference of usernames and deni [truncated]
CVE-2026-53675 is a MEDIUM-severity vulnerability in BuddyPress 14.4.0. The vulnerability is an insecure direct object reference in the friends REST API, allowing any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary user_id because the get_items_permissions_check method only verifies that the requester is logged in and neve [truncated]
CVE-2026-53673 is an insecure direct object reference vulnerability in BuddyPress 14.4.0. The vulnerability exists in the messages REST API, where an authenticated attacker can access arbitrary private message threads by supplying a user_id parameter in the request. The get_item_permissions_check method validates the supplied user_id instead of the logged-in user and is reused by the update and delete han [truncated]