Executive brief
BuddyPress is a popular WordPress plugin used to build social networking communities. A security flaw in versions 6.0.0 through 6.2.0 allows users with moderator privileges to inject malicious scripts into site pages. If an administrator views or previews these pages, the attacker could hijack their session, redirect users to malicious websites, or perform phishing attacks, potentially compromising the entire site.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in BuddyPress versions 6.0.0 through 6.2.0. The flaw is located in the handling of the 'figure' parameter within 'wp:html' blocks. Authenticated attackers with moderator-level privileges can use a POST request to inject malicious iframe elements containing JavaScript event handlers (such as 'onload'). When an administrator or other privileged user previews or views the affected content, the script executes in their browser context. This can lead to session hijacking, unauthorized administrative actions, or persistent phishing. The vulnerability was publicly disclosed in late 2020.
Affected products
- BuddyPress BuddyPress 6.0.0 - 6.2.0
Timeline
- 2020-11-13: disclosed: Initial public disclosure by Vulnerability-Lab
- 2020-11-17: other: Exploit published to Exploit-DB
- 2026-05-16: advisory: NVD/VulnCheck advisory published