Description
WordPress Plugin BuddyPress is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently add a style attributes to "span" and "p" elements in possible rich text fields of their profile page. WordPress Plugin BuddyPress version 6.3.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 6.4.0 or latest
References
Related Vulnerabilities
PHP Improper Input Validation Vulnerability (CVE-2017-8923)
PHP Uncontrolled Resource Consumption Vulnerability (CVE-2011-3336)
PHP Resource Management Errors Vulnerability (CVE-2006-1991)
WordPress 4.3.x Multiple Vulnerabilities (4.3 - 4.3.21)
Jboss EAP Cryptographic Issues Vulnerability (CVE-2014-0035)