CVE-2026-96554 in Platform Plugin
Summary
by MITRE • 10/31/2026
The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the "Enable social group creation by all members" setting to be enabled, which is the default and permits Subscriber-level users to create groups; exploitation is not possible if group creation is restricted to administrators.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/31/2026
The BuddyBoss Platform plugin for WordPress contains a critical security vulnerability classified as Stored Cross-Site Scripting within versions up to 3.6.0. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing the Group Name field during group creation operations. The technical root cause lies in the failure of the application to properly validate or encode user-supplied data before storing it in the database and subsequently rendering it on web pages without appropriate encoding. Consequently, malicious actors can inject arbitrary JavaScript code into the stored content associated with a social group's name. This type of vulnerability is formally categorized under CWE-79, which addresses Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The persistence of this script in the database means that every time an administrator or another user views the affected group page, the malicious payload executes within their browser context, leveraging the trust relationship between the victim and the application.
The operational impact of this vulnerability is significant due to its stored nature and the specific access requirements for exploitation. An attacker must possess authenticated subscriber-level access or higher privileges on the WordPress site to trigger the injection vector by creating a group with a malicious name payload. Furthermore, successful exploitation is contingent upon the site administrator having enabled the setting that allows all members to create social groups, which is the default configuration in BuddyBoss Platform installations. If this feature is disabled and restricted to administrators only, the attack surface for lower-privileged users is effectively closed. Once exploited, the injected script executes with the privileges of the victim user who views the page. This can lead to session hijacking through cookie theft, defacement of the website interface, redirection to phishing sites, or further propagation of malware within the organization's network if internal resources are accessible from the browser context. The attack aligns with ATT&CK technique T1059.007, which covers JavaScript execution in web browsers, and can facilitate subsequent techniques such as Credential Access via Browser Session Hijacking (T1539) or Collection of Data from Local System if combined with other client-side attacks.
Mitigation strategies for this vulnerability involve both immediate remediation steps and long-term security hardening practices. The primary defense is to upgrade the BuddyBoss Platform plugin to a version newer than 3.6.0, where developers have implemented proper input validation and output encoding mechanisms to neutralize script injection attempts. For environments that cannot immediately patch due to compatibility constraints or other operational reasons, administrators should disable the social group creation feature for non-administrative users by adjusting the BuddyBoss settings to restrict group creation privileges exclusively to administrator-level accounts. This effectively removes the attack vector available to subscriber and lower-tier authenticated users. Additionally, implementing a Content Security Policy header can help mitigate the impact of any successful XSS attacks by restricting the sources from which scripts are allowed to execute, thereby preventing the injection of external malicious code even if it is stored in the database. Regular security audits and penetration testing should be conducted to identify similar input handling flaws across other plugins and core WordPress functionalities to ensure comprehensive protection against web-based application vulnerabilities.