BuddyPress

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

259 searches this plugin appeared in over the last 90 days, 20 listed. 192 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 23% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 3 months ago and a band this size takes about a year or more to cross, so the real count is still just under 100K.

1. ★★★★★ Emilio Lejit

   8mo ago

   Great, magnificent and impeccable plugin. Does exactly what’s described.

   Read on wp.org ↗
2. ★★★★★ trentkanor

   1.1y ago

   Not the easiest

   Read on wp.org ↗
3. ★★★★★ ahmedahmedanter0

   1.4y ago

   This plugin needs to be completely rebuilt from scratch, with a particular focus on redesigning the user interface.

   Read on wp.org ↗
4. ★★★★★ belendelamonedarico

   1.5y ago

   Lo probé en un sitio de comunidad y la verdad es que cumple su función. Tiene potencial si se le dedica algo de tiempo a personalizarlo. La interfaz puede parecer un poco antigua, pero lo compensa con su funcionalidad.

   Read on wp.org ↗
5. ★★★★★ Cristian

   1.5y ago

   Desde que implementé BuddyPress en mi sitio, la interacción entre mis usuarios ha mejorado notablemente. Me gusta cómo me permite crear perfiles personalizados, grupos de interés y un muro de actividad donde la comunidad puede compartir contenido fácilmente. Lo que más valoro es la posibilidad de fomentar discusiones y conexiones entre los miembros sin necesidad de complejas configuraciones. Las funciones básicas de mensajería y notificaciones mantienen a todos comprometidos con el sitio. BuddyPress ha sido la herramienta perfecta para transformar mi web en unespacio social dinámico y participativo.

   Read on wp.org ↗
6. ★★★★★ albertomartinnicolas

   1.5y ago

   I’ve tried BuddyPress in a test project and it works great for creating a simple social network inside WordPress. It’s flexible, powerful, and well maintained. Thanks to the team behind it!

   Read on wp.org ↗
7. ★★★★★ monordycom

   1.7y ago

   What a huge disaster !!!! congratulation you have distroyed my community by changing the way we select the registration form & page!!!! now we can’t choose a custom page for register, we can just change URL !That’s absolutely useless and shows that you have no respect to the users. I definitly don’t recommand this poor quality plugin This topic was modified 1 year, 5 months ago by monordycom.

   Read on wp.org ↗
8. ★★★★★ Jeremy

   2.4y ago

   The update to the new major version absolutely destroyed my BuddyPress community and content. Even after trying the BP Classic plugin, it was still non-functional, BP links would not go to the right pages, and lots of errors and 404’s. I’ve tried troubleshooting: I didn’t have any 3rd party BuddyPress plugins I, ran BP repair tools, cleaned my database out, lots. I’m just glad most of our community content was in bbPress, the forum software. That is all preserved. All the updates, memberships, friendships, and more that we depended on BuddyPress for is ruined. 🙁 Buddypress brought some interesting community functions, but after this disaster of a release, and the huge problems and time its been costing me, we need to reassess if it will be a part of our community’s future. I will look into a few other resolutions and if those don’t work, I’m giving up on Buddypress completely. This topic was modified 2 years, 1 month ago by Jeremy. This topic was modified 2 years, 1 month ago by Jeremy.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 14.4.0 See: https://codex.buddypress.org/releases/version-14-4-0/ 14.4.0
2. — Version 14.3.4 See: https://codex.buddypress.org/releases/version-14-3-4/ 14.3.4
3. — Version 14.3.3 See: https://codex.buddypress.org/releases/version-14-3-3/ 14.3.3
4. — Version 14.3.1 See: https://codex.buddypress.org/releases/version-14-3-1/ 14.3.1
5. — Version 14.2.1 See: https://codex.buddypress.org/releases/version-14-2-1/ 14.2.1
6. — Version 14.1.0 See: https://codex.buddypress.org/releases/version-14-1-0/ 14.1.0

3 open vulnerabilities affect the current version (14.5.4). 26 of 29 disclosed are patched.

1. Patched Medium · 4.3 BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion ↗
   2026-09-10 CVE-2024-12145 Missing Authorization Affects <= 14.3.3 Patched in 14.3.4
2. Open High · 7.5 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data ↗
   2026-07-29 CVE-2026-1360 Deserialization of Untrusted Data Affects <= 14.5.0 No patch available
3. Patched Medium · 4.3 BuddyPress <= 14.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure ↗
   2026-07-13 CVE-2026-8155 Authorization Bypass Through User-Controlled Key Affects <= 14.4.0 Patched in 14.5.0
4. Open Medium · 4.3 BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference ↗
   2026-06-09 CVE-2026-53675 Authorization Bypass Through User-Controlled Key Affects <= 14.4.0 No patch available
5. Open Medium · 4.3 BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference ↗
   2026-06-09 CVE-2026-53673 Authorization Bypass Through User-Controlled Key Affects <= 14.4.0 No patch available
6. Patched High · 7.3 BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution ↗
   2026-01-22 CVE-2024-11976 Improper Control of Generation of Code Affects <= 14.3.3 Patched in 14.3.4
7. Patched Medium · 5.3 BuddyPress <= 14.3.4 - Missing Authorization ↗
   2025-09-27 CVE-2025-62022 Missing Authorization Affects <= 14.3.4 Patched in 14.4.0
8. Patched High · 8.1 BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal ↗
   2024-10-24 CVE-2024-10011 Improper Limitation of a Pathname to a Restricted Directory Affects <= 14.1.0 Patched in 14.2.1
9. Patched Medium · 6.4 BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2024-06-11 CVE-2024-4892 Improper Neutralization of Input During Web Page Generation Affects <= 12.5.0 Patched in 12.5.1
10. Patched Medium · 6.4 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-05-03 CVE-2024-3974 Improper Neutralization of Input During Web Page Generation Affects <= 12.4.0 Patched in 12.4.1
11. Patched Medium · 6.4 BuddyPress <= 11.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-12-26 CVE-2023-50880 Improper Neutralization of Input During Web Page Generation Affects <= 11.3.1 Patched in 11.3.2
12. Patched Critical · 9.8 BuddyPress <= 9.0.0 - SQL Injection ↗
    2021-08-18 Improper Neutralization of Special Elements used in an SQL Command Affects <= 9.0.0 Patched in 9.1.1
13. Patched High · 8.8 BuddyPress <= 9.0.0 - Information Disclosure via REST API ↗
    2021-08-18 Incorrect Authorization Affects <= 9.0.0 Patched in 9.1.1
14. Patched Medium · 5.4 BuddyPress <= 7.2.1 - Missing Authorization to Group Creation ↗
    2021-04-14 Incorrect Authorization Affects <= 7.2.1 Patched in 7.3.0
15. Patched High · 8.8 BuddyPress <= 7.2.1 - Insufficient Privilege De-escalation ↗
    2021-04-14 Improper Access Control Affects <= 7.2.1 Patched in 7.3.0
16. Patched Medium · 5.4 BuddyPress <= 7.2.1 - Missing Authorization to Private Post Activity ↗
    2021-04-14 Incorrect Authorization Affects <= 7.2.1 Patched in 7.3.0
17. Patched Medium · 5.4 BuddyPress <= 7.2.1 - Missing Authorization to Unauthorized Group Access ↗
    2021-04-14 Incorrect Authorization Affects <= 7.2.1 Patched in 7.3.0
18. Patched Medium · 5.4 BuddyPress <= 7.2.0 - Authorization Bypass to Friend Invite ↗
    2021-03-17 Improper Access Control Affects <= 7.2.0 Patched in 7.2.1
19. Patched Medium · 4.6 BuddyPress - 7.0.0 - 7.2.0 - Insufficient Privilege De-escalation ↗
    2021-03-16 Incorrect Privilege Assignment Affects 7.0.0 - 7.2.1 Patched in 7.2.1
20. Patched High · 8.8 BuddyPress 5.0.0-7.2.0 - Privilege Escalation via REST API ↗
    2021-03-16 CVE-2021-21389 Incorrect Authorization Affects 5.0.0 - 7.2.0 Patched in 7.2.1
21. Patched Medium · 6.5 BuddyPress <= 7.2.0 - Authorization Bypass to Private Message Disclosure ↗
    2021-03-07 Improper Access Control Affects <= 7.2.0 Patched in 7.2.1
22. Patched Medium · 6.4 BuddyPress <= 6.3.0 - Insufficient Input Validation ↗
    2020-11-27 Improper Neutralization of Input During Web Page Generation Affects < 6.4.0 Patched in 6.4.0
23. Patched High · 7.5 BuddyPress <= 5.1.1 - Sensitive Information Disclosure ↗
    2020-01-02 CVE-2020-5244 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.1.1 Patched in 5.1.2
24. Patched Medium · 5.4 BuddyPress <= 5.1.0 - Denial of Service ↗
    2019-12-23 Uncontrolled Resource Consumption Affects <= 5.1.0 Patched in 5.1.1
25. Patched Critical · 10.0 BuddyPress 2.0 - 2.7.3 - Unauthenticated Arbitrary File Deletion ↗
    2016-12-23 Improper Limitation of a Pathname to a Restricted Directory Affects 2.0 - 2.7.3 Patched in 2.7.4
26. Patched High · 8.8 BuddyPress <= 2.3.4 - Privilege Escalation ↗
    2015-11-11 Improper Privilege Management Affects <= 2.3.4 Patched in 2.3.5
27. Patched Medium · 6.4 BuddyPress <= 1.9.1 - Stored Cross-Site Scripting ↗
    2014-08-01 CVE-2014-1888 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.1 Patched in 1.9.2
28. Patched Medium · 6.5 BuddyPress <= 1.9.1 - Authorization Bypass ↗
    2014-02-05 CVE-2014-1889 Improper Authentication Affects < 1.9.2 Patched in 1.9.2
29. Patched Critical · 9.8 BuddyPress - 1.5-1.5.4 - SQL Injection ↗
    2012-03-27 CVE-2012-2109 Improper Neutralization of Special Elements used in an SQL Command Affects 1.5 - 1.5.4 Patched in 1.5.5

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 129 languages, 32 at 90% or more

Plus 105 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-08-03 100K+ → 90K+ down after 1 days in tier
2. 2026-08-02 90K+ → 100K+ up after 1 days in tier
3. 2026-08-01 100K+ → 90K+ down after 1 days in tier
4. 2026-07-31 90K+ → 100K+ up after 9 days in tier
5. 2026-07-22 100K+ → 90K+ down after 1420 days in tier
6. 2022-09-01 200K+ → 100K+ down after 2312 days in tier
7. 2016-05-03 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for BuddyPress into a readme, a review or a deck. It updates itself.

BuddyPress: 90K+ active installs, 4.1★ (375 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/buddypress