Reflected XSS Vulnerability in Mass Messaging for BuddyPress by Eliott Robson

CVE-2025-23798

What is CVE-2025-23798?

An improper neutralization of user input during the generation of web pages in the Mass Messaging component of BuddyPress exposes the application to a reflected XSS attack. This vulnerability allows attackers to execute malicious scripts in the context of the user's browser, potentially leading to unauthorized actions, data theft, or further exploitation of the affected site. The issue impacts versions n/a up to 2.2.1, posing significant risks to users and administrators unaware of the threat.

References