CVE-2014-1888: XSS
Published Feb 28, 2014
·Updated
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Affected Software
46 affected components
BuddyPress BuddyPress<=1.9
BuddyPress BuddyPress=1.5
BuddyPress BuddyPress=1.5.1
BuddyPress BuddyPress=1.5.2
BuddyPress BuddyPress=1.5.3
BuddyPress BuddyPress=1.5.3.1
BuddyPress BuddyPress=1.5.4
BuddyPress BuddyPress=1.5.5
BuddyPress BuddyPress=1.5.6
BuddyPress BuddyPress=1.5.7
BuddyPress BuddyPress=1.6
BuddyPress BuddyPress=1.6.1
BuddyPress BuddyPress=1.6.2
BuddyPress BuddyPress=1.6.3
BuddyPress BuddyPress=1.6.4
BuddyPress BuddyPress=1.6.5
BuddyPress BuddyPress=1.7
BuddyPress BuddyPress=1.7.1
BuddyPress BuddyPress=1.7.2
BuddyPress BuddyPress=1.7.3
BuddyPress BuddyPress=1.8
BuddyPress BuddyPress=1.8.1
WordPress WordPress
All of the following
Any of the following
BuddyPress BuddyPress<=1.9
BuddyPress BuddyPress=1.5
BuddyPress BuddyPress=1.5.1
BuddyPress BuddyPress=1.5.2
BuddyPress BuddyPress=1.5.3
BuddyPress BuddyPress=1.5.3.1
BuddyPress BuddyPress=1.5.4
BuddyPress BuddyPress=1.5.5
BuddyPress BuddyPress=1.5.6
BuddyPress BuddyPress=1.5.7
BuddyPress BuddyPress=1.6
BuddyPress BuddyPress=1.6.1
BuddyPress BuddyPress=1.6.2
BuddyPress BuddyPress=1.6.3
BuddyPress BuddyPress=1.6.4
BuddyPress BuddyPress=1.6.5
BuddyPress BuddyPress=1.7
BuddyPress BuddyPress=1.7.1
BuddyPress BuddyPress=1.7.2
BuddyPress BuddyPress=1.7.3
BuddyPress BuddyPress=1.8
BuddyPress BuddyPress=1.8.1
WordPress WordPress
Event History
Feb 28, 2014
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Mar 1, 2014
Data Sourced
via NVD·12:01 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1888?
CVE-2014-1888 is considered to have a medium severity due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-1888?
To fix CVE-2014-1888, upgrade to BuddyPress version 1.9.2 or later.
3
What versions of BuddyPress are affected by CVE-2014-1888?
CVE-2014-1888 affects BuddyPress versions prior to 1.9.2, including versions 1.5 through 1.8.1.
4
Can CVE-2014-1888 be exploited without authentication?
Yes, CVE-2014-1888 can be exploited without authentication by leveraging certain vulnerabilities.
5
What type of vulnerability is CVE-2014-1888 classified as?
CVE-2014-1888 is classified as a cross-site scripting (XSS) vulnerability.