Cross-site Scripting Vulnerability in BuddyDev BuddyPress Notification Widget

CVE-2025-58263

What is CVE-2025-58263?

The BuddyDev BuddyPress Notification Widget contains a vulnerability that allows for Stored Cross-site Scripting (XSS) attacks. This issue arises from improper neutralization of user input during web page generation, making it possible for an attacker to inject malicious scripts that can be executed in the context of a user's browser. As a result, this could lead to unauthorized access to sensitive information or further attacks on users interacting with the affected versions of the widget.

References