Description
WordPress Plugin BuddyPress is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently add a style attributes to "span" and "p" elements in possible rich text fields of their profile page. WordPress Plugin BuddyPress version 6.3.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 6.4.0 or latest
References
Related Vulnerabilities
Oracle JRE CVE-2019-2977 Vulnerability (CVE-2019-2977)
Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4194)
WordPress Plugin Awesome Support-WordPress HelpDesk & Support Cross-Site Scripting (6.0.6)
Apache Tomcat Exposure of Resource to Wrong Sphere Vulnerability (CVE-2017-5648)
Vanilla Forums Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2018-15833)