Stored Cross-Site Scripting in Buddyboss Platform Plugin for WordPress

CVE-2024-13859

What is CVE-2024-13859?

The Buddyboss Platform plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'bp_nouveau_ajax_media_save' function. This issue affects all versions up to and including 2.8.50, stemming from insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access or higher can exploit this flaw to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses these compromised pages. While a partial patch was released in version 2.8.41, users are urged to update to the latest version to mitigate the risks associated with this vulnerability.

References