CVE Database /
CVE-2024-13859
CVE · Medium
CVE-2024-13859 — Buddyboss Platform [buddyboss-platform] < 2.8.51
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-13859
|
Buddyboss Platform [buddyboss-platform] < 2.8.51 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 2.8.51
|
2.8.51 |
2025-05-01 |
—
|
CVE-2024-13859
The Buddyboss Platform plugin for WordPress contains a stored cross-site scripting vulnerability in the 'bp_nouveau_ajax_media_save' function affecting versions through 2.8.50, where inadequate input validation and output encoding allows authenticated users with subscriber privileges or higher to embed malicious scripts into pages that run when other users view them. The flaw was partially addressed in version 2.8.41, with a complete fix available in 2.8.51 and later.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings