Activity Plus Reloaded CVE-2025-62949

Exploitation requires an authenticated account on the target WordPress/BuddyPress site with at least the privilege level needed to submit activity content via the Activity Plus Reloaded plugin (PR:L), and it requires a second user (such as an administrator or another member) to view the activity stream containing the stored payload (UI:R) for the script to fire. This is a stored/persistent XSS, so the payload is saved server-side and triggers on each view, but the dependency on both low-privilege authentication and victim interaction materially limits real-world risk - a site that does not allow untrusted users to register or post activity content has a sharply reduced attack surface. The plugin and its BuddyPress activity feature must be installed and active.

This is a stored cross-site scripting (CWE-79) flaw in the BuddyDev 'Activity Plus Reloaded for BuddyPress' WordPress plugin (through 1.1.2), rated CVSS 6.5 (Medium). The provided vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that nonetheless requires an authenticated low-privilege account (PR:L) and victim interaction (UI:R, i.e. an admin or another user must view the poisoned activity content); the scope change (S:C) reflects that injected script executes in a different security context (the victim's browser/session). The exploitation signals point AWAY from urgent priority: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced - only a Patchstack database entry. No SSVC decision data was supplied. The signals are internally consistent rather than conflicting: a Medium CVSS driven by partial impacts (C:L/I:L/A:L) aligns with a low EPSS and absence of known exploitation. Bottom line: this is a genuine but lower-tier issue typical of authenticated stored-XSS in a niche plugin - patch in routine cycles, not an emergency, unless the affected site runs untrusted or self-registering users who could plant the payload.

An attacker with a low-privilege authenticated account on a BuddyPress site posts activity content via the Activity Plus Reloaded plugin containing a malicious script payload that is stored without proper neutralization. When a site administrator or another member subsequently views that activity stream, the script executes in their browser session, enabling session/cookie theft or actions in their context. No public exploit code is identified at time of analysis.