WordPress Plugin Vulnerabilities

BuddyPress < 11.3.2 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its Members/Groups block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
buddypress
Fixed in 11.3.2

References

CVE
CVE-2023-50880
URL
https://patchstack.com/database/vulnerability/buddypress/wordpress-buddypress-plugin-11-3-1-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
ec32ef7a-9be8-4854-9622-8693b10aface

Timeline

Publicly Published
2023-12-26 (about 2 years ago)
Added
2024-01-04 (about 2 years ago)
Last Updated
2024-01-04 (about 2 years ago)

Other

Published
Title
Published
2024-11-25
Title
Elementor Website Builder < 3.25.8 - Contributor+ Stored XSS
Published
2024-09-04
Title
Team Members Showcase < 4.4.2 - Editor+ Stored XSS
Published
2025-01-07
Title
Easy Form Builder < 3.8.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2024-03-16
Title
Coupon Affiliates < 5.12.8 - Reflected Cross-Site Scripting
Published
2024-12-05
Title
Board Document Manager from CHUHPL <= 1.9.1 - Reflected Cross-Site Scripting