Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2020-37233

WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting

WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers like onload that execute when administrators or privileged users preview or view the affected page content, enabling session hijacking and persistent phishing attacks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Boonebgorges Wordpress
Products
Buddypress Docs Buddypress Cover Wordpress
CVE-2024-35746

WordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover: from n/a through 2.1.4.2.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Buddypress Cover Project Wordpress
Products
Buddypress Cover Buddypress Cover