Lucene search

CVE-2024-3974 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

🗓️ 09 May 2024 20:23:03Reported by WordfenceType

BuddyPress plugin allows authenticated attackers to inject arbitrary scripts via 'user_name' paramete

Reporter	Title	Published	Views	Family All 6
WPVulnDB	BuddyPress < 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting	7 May 202400:00	–	wpvulndb
Cvelist	CVE-2024-3974 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting	9 May 202420:03	–	cvelist
CVE	CVE-2024-3974	14 May 202415:42	–	cve
Patchstack	WordPress BuddyPress Plugin <= 12.4.0 is vulnerable to Cross Site Scripting (XSS)	5 May 202400:00	–	patchstack
NVD	CVE-2024-3974	14 May 202415:42	–	nvd
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (April 29, 2024 to May 5, 2024)	9 May 202416:49	–	wordfence

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/buddypress/trunk/bp-members/bp-members-blocks.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/3657384e-025a-44ad-8b7e-1a2fea17dcc3
plugins	www.plugins.trac.wordpress.org/browser/buddypress/trunk/bp-members/bp-members-admin.php
plugins	www.plugins.trac.wordpress.org/changeset/3079691/buddypress

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

09 May 2024 20:03Current

5.8Medium risk

Vulners AI Score5.8

CVSS36.4

EPSS0.00045

SSVC