Junglewise Threat Intelligence

CVE-2026-4653: bouncingsprout Block, Suspend, Report for BuddyPress Stored XSS in link parameter

CVE-2026-4653 · Severity: medium · CVSS 6.4 · Published 2026-07-09

Executive brief

The Block, Suspend, Report for BuddyPress plugin for WordPress, which provides community moderation tools, contains a security flaw that allows users with basic account access to inject malicious scripts into the website. These scripts can automatically run in the browsers of other users, including administrators, when they view specific pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Block, Suspend, Report for BuddyPress plugin due to improper neutralization of user-supplied input in the 'link' parameter. The flaw is located within the reporting functionality, specifically affecting components like 'report-cpt-main-metabox.php' and 'class-bp-toolkit-report.php'. An authenticated attacker with at least subscriber-level privileges can submit a malicious payload that is stored in the database. Because the plugin fails to properly sanitize this input or escape it upon output, the script executes in the context of any user (including administrators) who views the affected report page. This can lead to session hijacking or unauthorized administrative actions. The vulnerability is addressed in versions following 3.6.4.

Affected products

  • bouncingsprout Block, Suspend, Report for BuddyPress up to and including 3.6.4

Timeline

  • 2026-07-09: advisory: NVD publication date
  • 2026-07-09: disclosed: Wordfence advisory published

References