Description
WordPress Plugin BuddyPress is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently add a style attributes to "span" and "p" elements in possible rich text fields of their profile page. WordPress Plugin BuddyPress version 6.3.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 6.4.0 or latest
References
Related Vulnerabilities
MySQL CVE-2022-21600 Vulnerability (CVE-2022-21600)
MyBB CVE-2011-5133 Vulnerability (CVE-2011-5133)
ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-1499)
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-13258)
Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-38268)