CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.
Explanation of Vulnerability in Simple Terms
BuddyPress versions up to 11.3.1 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with a low-privilege account can craft a request that, when a victim visits a page, executes JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions on the site.
What an attacker can do
Run malicious JavaScript in other users' browsers to steal session cookies, credentials, or perform actions on their behalf.
Potential impact on your site
Authenticated users can inject scripts affecting other users across the site; admin accounts are at risk if they visit compromised pages.
Conditions required to exploit
Attacker needs a low-privilege account on the site; victim must visit a page containing the attacker's payload.
Key dates
External resources
Related vulnerabilities
