CVE-2024-4892: BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘displayname’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4892?
CVE-2024-4892 is classified as a medium severity vulnerability due to the potential for authenticated attackers to exploit it.
How do I fix CVE-2024-4892?
To resolve CVE-2024-4892, update the BuddyPress plugin to version 12.4.2 or later, which addresses the vulnerability.
Who is affected by CVE-2024-4892?
CVE-2024-4892 affects all versions of the BuddyPress plugin up to and including 12.4.1.
What type of vulnerability is CVE-2024-4892?
CVE-2024-4892 is a Stored Cross-Site Scripting vulnerability that arises from insufficient input sanitization.
Can CVE-2024-4892 be exploited remotely?
CVE-2024-4892 can only be exploited by authenticated attackers with subscriber-level access or higher.