WordPress Plugin Vulnerabilities

BuddyPress Docs < 2.2.4 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
buddypress-docs
Fixed in 2.2.4

References

CVE
CVE-2024-9207
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b2181c89-4f40-45b9-8c12-448ca263a2f2

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
vgo0
Verified
No
WPVDB ID
55a56ed7-e5d8-4a72-84e5-22c9310f05c6

Timeline

Publicly Published
2024-10-07 (about 1 year ago)
Added
2024-10-07 (about 1 year ago)
Last Updated
2025-04-02 (about 1 year ago)

Other

Published
Title
Published
2024-10-15
Title
Accordion Slider < 1.9.12 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attribute
Published
2024-10-31
Title
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2025-04-01
Title
Small Package Quotes – Worldwide Express Edition < 5.2.19 - Reflected Cross-Site Scripting
Published
2024-09-24
Title
Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS
Published
2024-09-30
Title
XO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting