BuddyBoss Cross-Site Scripting Vulnerability

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. A cross-site scripting vulnerability exists in BuddyBoss version 2.2.9 that originates from allowing a local attacker to execute a malicious payload via the name=image.jpg parameter...

BuddyBoss Security Breach

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. A security vulnerability exists in version 2.2.9 of BuddyBoss that stems from allowing authenticated users to access and rename other users' photo albums...

PT-2023-23946 · Buddyboss · Buddyboss

Name of the Vulnerable Software and Affected Versions: BuddyBoss version 2.2.9 Description: The issue is a Cross-Site Scripting vulnerability that could allow a local attacker with basic privileges to execute a malicious payload through the name parameter, specifically when set to image.jpg. This...

PT-2023-23944 · Buddyboss · Buddyboss

Name of the Vulnerable Software and Affected Versions: BuddyBoss version 2.2.9 Description: The issue allows an authenticated user to access and rename other users' albums by exploiting an authorization bypass vulnerability. This can be done by changing the album identification id. Recommendation...

WordPress Member Profile Forms / Custom Registration / Post From Profile in BuddyPress / BuddyBoss Plugin <= 1.4.10 is vulnerable to Cross Site Scripting (XSS)

Software Member Profile Forms / Custom Registration / Post From Profile in BuddyPress / BuddyBoss Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Cla...

WordPress Display Data on your site! Create Dynamic Content Templates from any form of data. Works with ACF, Pods, BuddyPress/ BuddyBoss Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Display Data on your site! Create Dynamic Content Templates from any form of data. Works with ACF, Pods, BuddyPress/ BuddyBoss Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-43334

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-43334

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field...

Cross site scripting

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field...

Default configuration

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. email protected wou...

CVE-2021-43334

CVE-2021-43334 affects BuddyBoss Platform (≤ 1.8.0) with a Cross-site Scripting (XSS) vulnerability in the Group Name/Group Description fields. The root cause is a lack of input validation in the bp_register_active_group_types function within bp-groups-functions.php, leading to script injection. ...

CVE-2021-44692

The CVE describes a vulnerability in BuddyBoss Platform up to version 1.8.0 where user emails can be inferred and exposed. When a new user is created, a UID is generated for the profile, which encodes the user’s private email address (symbols removed, periods replaced with hyphens). The resulting...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

BuddyBoss Platform 跨站脚本漏洞

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss that runs online communities on WordPress. A cross-site scripting vulnerability exists in BuddyBoss Platform that stems from BuddyBoss Platform allowing XSS via the Group Name or Group Description fields...

BuddyBoss Platform 信息泄露漏洞

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. BuddyBoss Platform has a security vulnerability that can be exploited by a remote attacker to obtain each user's email address...

WordPress Buddyboss Platform plugin <= 1.7.8 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered in WordPress Buddyboss Platform plugin versions = 1.7.8. Solution Update the WordPress Buddyboss Platform plugin to the latest available version at least 1.7.9...

WordPress buddyboss-media plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. buddyboss-media is a BuddyBoss Media Library plugin used in it. A cross-site scripting vulnerability exists in the WordPress...