CVE-2024-3974 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions...

WordPress BuddyPress Plugin <= 12.4.0 is vulnerable to Cross Site Scripting (XSS)

Software BuddyPress Type Plugin Vulnerable versions = 12.4.0 Fixed in 12.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3974 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c936264fa18b Credits wesley wcraft Require...

CVE-2022-45074

Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...

CVE-2022-45074 WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...

CVE-2022-45074

CVE-2022-45074 refers to a CSRF vulnerability in the WordPress Activity Reactions for Buddypress plugin (versions

PT-2023-14586 · WordPress · Activity Reactions For Buddypress

Name of the Vulnerable Software and Affected Versions: Activity Reactions For Buddypress plugin versions = 1.0.22 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...

CVE-2014-1889

The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check...

Information disclosure

The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check...

WordPress Plugin BuddyPress Activity Plus 'admin-ajax' Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin BuddyPress Activity Plus 'admin-ajax'. An attacker...

CVE-2014-1888

Cross-site scripting XSS vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-188...

CVE-2014-1888

Cross-site scripting XSS vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-188...

WordPress Buddypress 1.9.1 Privilege Escalation Vulnerability

WordPress Buddypress plugin versions 1.9.1 and below suffer from a privilege escalation vulnerability. Vulnerability: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power 0day.today 2018-04-01...

Sql injection

SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activitywidgetfilter action...

CVE-2012-2109

SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activitywidgetfilter action...

WordPress BuddyPress Plugin 1.2.10 - HTML Injection Vulnerability

BuddyPress plugin is prone to an HTML-injection vulnerability because of failure to sufficiently clean up user-supplied input. It allows an attacker to execute arbitrary script code in the browser in the context of the affected websites. In this way an attacker can steal cookie-based authenticati...