Security Alert Summary
The BuddyBoss Platform plugin for WordPress is affected by a stored cross-site scripting (XSS) vulnerability in the Group Name field in versions up to and including 3.6.0. Authenticated users with subscriber-level access and above can inject scripts that execute when other users view the injected page if the “Enable social group creation by all members” setting is enabled (this is the default). Exploitation is not possible when group creation is restricted to administrators.
CVE Details
- CVE ID: CVE-2026-96554
- Affected component: BuddyBoss Platform plugin for WordPress (Vendor: Boss Media)
- Affected versions: All versions up to and including 3.6.0
- Published: October 31, 2026 at 10:16:38 AM UTC
- Last modified: October 31, 2026 at 10:16:38 AM UTC
- CVSS v3.1: Base Score 6.4, MEDIUM — Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Exploitable by authenticated users. Privileges required: LOW (subscriber-level or higher). User interaction: NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This vulnerability is a stored cross-site scripting issue caused by insufficient input sanitization and output escaping of the Group Name value. When the site setting “Enable social group creation by all members” is enabled (the default), users with subscriber-level access and above can create groups. An attacker can submit a Group Name containing JavaScript or other executable content that is stored by the application and then rendered to other users without proper escaping.
When a user views a page that displays the injected Group Name, the browser will execute the injected script in the context of the site. The vulnerability exists because input is not sufficiently sanitized on save and/or output is not escaped on display. Exploitation requires an authenticated user with the ability to create groups under the described setting; if group creation is limited to administrators, exploitation is not possible.
How This Could Impact Your Website
In a realistic scenario, an external contributor or low-privilege user (subscriber-level) who can create groups may submit a crafted Group Name that embeds a script. When internal staff or the site owner view the group page, the script can run in their browsers. Practical consequences include exposure of profile details visible to the page, potential capture of session-scoped data presented to the browser, and increased risk of targeted phishing or social engineering if email addresses or other identifiers are accessible.
For example, a site owner or editor who regularly reviews new groups could be exposed to a script that collects displayed user information or modifies content presented to the user, leading to social engineering opportunities against staff or contractors. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially limiting who can create groups and removing unnecessary contributor-level permissions.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and regularly audit installed extensions.
- Monitor site activity and logs for unusual behavior, including unexpected group creation or content changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
