CVE-2024-13402 BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'
MediumCVSS 5.4
EPSS 0.24%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress buddyboss-platform(WordPress) | < 2.8.00 | 2.8.00 |
| Boss Media BuddyBoss Platform | <= 2.7.70 | No fix listed |
| Buddyboss Platform | < 2.8.00 | 2.8.00 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- www.wordfence.com third-party-advisory
- www.buddyboss.com release-notes