Stored Cross-Site Scripting Vulnerability in BuddyBoss Platform Plugin for WordPress

CVE-2026-96554

What is CVE-2026-96554?

The BuddyBoss Platform plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the Group Name feature. This issue affects all versions up to and including 3.6.0, due to inadequate input sanitization and output escaping mechanisms. Authenticated users with subscriber-level permissions can exploit this flaw by injecting malicious web scripts into group pages. When the setting for 'Enable social group creation by all members' is activated—typically the default—these vulnerabilities allow the potential for harmful scripts to execute whenever other users access the compromised pages. Restricting group creation to administrators mitigates this risk.

References