CVE-2017-1000227

The CVE targets Salutation Responsive WordPress + BuddyPress Theme, version 3.0.15. A Stored XSS vulnerability exists in this theme, enabling a logged-in attacker to perform admin-like actions. Several sources (e.g., NVD entry for CVE-2017-1000227 and related advisories) describe the issue as a C...

WordPress: [BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpoint

Hi, In a similar manner to 228569, it is currently possible to execute authenticated open redirections via the wphttpreferer parameter used in the BuddyPress extended user edit screen. Proof of concept Upon accessing the below URL, please select the "Update Profile" button, then select the "←Back...

WordPress: Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE.

Description This report is very similar to https://hackerone.com/bugs?subject=user&reportid=203515 so I will not go into too much details. When uploading a avatar or profile background image thats larger than allowd, the error containing the filename will be output unsanitized leading to XSS...

Salutation Responsive 3.0.15 Cross Site Scripting

Details ================ Software: Salutation Responsive WordPress + BuddyPress Theme Version: 3.0.15 Homepage: https://themeforest.net/item/salutation-responsive-wordpress-buddypress-theme/548199 Advisory report: https://security.dxw.com/advisories/stored-xss-salutation-theme/ CVE: Awaiting...

Salutation Responsive WordPress + BuddyPress theme <=3.0.15 - Stored Cross-site scripting (XSS) vulnerability

WordPress premium Salutation Responsive WordPress + BuddyPress theme vulnerable due to the Stored Cross-site scripting XSS vulnerability found by Tom Adams. Solution Update Salutation Responsive WordPress + BuddyPress theme to the latest available version at least 3.0.16...

WordPress BuddyPress Docs Unauthorized Operation Vulnerability

WordPress is a suite of blogging platforms developed in the PHP language by the WordPress Software Foundation, which supports the hosting of personal blog sites on servers running PHP and MySQL.BuddyPress Docs is one of the plugins for adding collaborative workspaces. A security vulnerability...

Code injection

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...

CVE-2017-6954

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...

CVE-2017-6954

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...

CVE-2017-6954

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...

CVE-2017-6954

Vulnerability in BuddyPress Docs WordPress plugin (pre-1.9.3) in includes/component.php allows authenticated users to edit other users’ documents due to improper authorization. Impact is unauthorized edits of documents; CVSS base scores (4.0–4.3) indicate MEDIUM severity. Remediation: upgrade to ...

BuddyPress Docs <= 1.9.2 - Authenticated Lack of Authorisation

The BuddyPress Docs WordPress plugin was affected by an Authenticated Lack of Authorisation security vulnerability...

BuddyPress 2.0-2.7.3 - Arbitrary File Deletion

The BuddyPress WordPress plugin was affected by an Arbitrary File Deletion security vulnerability...

WordPress BuddyPress Plugin <= 2.7.3 - Arbitrary File Deletion

This plugin is prone to an arbitrary file deletion vulnerability. Solution Update the plugin...

WordPress: [Buddypress] Arbitrary File Deletion through bp_avatar_set

Hi, The bpavatarset action in BuddyPress when cropping avatars allows an attacker to arbitrarily delete a file the webserver can delete through the 'originalfile' parameter. For example: Create a user on a Buddypress-powered Wordpress instance any user is OK, doesn't need to be admin, just needs ...

WordPress BuddyPress Plugin <= 2.3.4 - Privilege Escalation

This plugin is prone to authenticated privilege escalation vulnerability. Solution Update the plugin...

BuddyPress <= 2.3.4 - Authenticated Privilege Escalation

According to the vendor, versions 2.0.4, 2.1.2, and 2.2.4 also contain a fix for this vulnerability...

WordPress Plugin BuddyPress Activity Plus 'admin-ajax' Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin BuddyPress Activity Plus 'admin-ajax'. An attacker...

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...

WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...