Stored Cross-Site Scripting in Buddyboss Platform for WordPress

CVE-2024-13858

What is CVE-2024-13858?

The Buddyboss Platform plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through the insufficient sanitization of the 'invitee_name' parameter. This flaw affects all versions prior to 2.8.50 and enables authenticated attackers with Subscriber-level permissions and higher to inject arbitrary web scripts into pages. These scripts execute when users access the compromised pages, posing a significant security risk. A partial fix was introduced in version 2.8.41, but earlier versions remain vulnerable.

References