CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers like onload that execute when administrators or privileged users preview or view the affected page content, enabling session hijacking and persistent phishing attacks.
Explanation of Vulnerability in Simple Terms
BuddyPress versions 6.2.0 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level account access can craft input that executes in other users' browsers when they view affected pages. The vulnerability requires user interaction—victims must visit a page containing the attacker's payload.
What an attacker can do
Inject JavaScript that runs in other users' browsers to steal session tokens, redirect them, or deface content.
Potential impact on your site
Authenticated users can compromise other users' sessions or perform actions on their behalf without their knowledge.
Conditions required to exploit
Attacker needs a low-privilege account on the site; victim must visit a page with the malicious payload.
Key dates
External resources
Related vulnerabilities
