What is the CVSS score of CVE-2026-4653?

CVE-2026-4653 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

BuddyPress bp-toolkit CVE-2026-4653

EUVD-2026-42519 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 Wordfence

GHSA-wf3h-wgr2-59j7

WordPress XSS Wordpress Plugin Block Suspend Report For Buddypress

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS still requires a victim to navigate to the injected page (UI:R); subscriber-level account needed (PR:L); payload executes in victim browser scope (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:31 vuln.today

CVE Published

Jul 09, 2026 - 06:52 nvd

MEDIUM 6.4

DescriptionCVE.org

The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 3.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in the Block, Suspend, Report for BuddyPress WordPress plugin (bp-toolkit) through version 3.6.4 allows low-privileged authenticated attackers to inject persistent malicious scripts via the 'link' parameter in report submissions. Authenticated users with subscriber-level access can plant JavaScript payloads that execute in any visitor's browser upon accessing the affected report pages, with Changed Scope (S:C) indicating execution in the victim's security context rather than the application's. No public exploit code has been identified at time of analysis and the vulnerability has not been added to CISA KEV, but on BuddyPress community sites with open registration the subscriber-level prerequisite is trivially satisfied.

Technical ContextAI

The affected plugin (CPE: cpe:2.3:a:bouncingsprout:block,_suspend,_report_for_buddypress:*:*:*:*:*:*:*:*) extends BuddyPress community functionality to allow members to block, suspend, or report other users. The 'link' parameter accepted in report submissions is insufficiently sanitized before database storage in includes/class-bp-toolkit-report.php at line 260, and insufficiently escaped before HTML rendering in admin/partials/report-cpt-main-metabox.php at line 115. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS pattern: attacker-controlled data enters the data store unsanitized and exits to the DOM without encoding. The Changed Scope in the CVSS vector reflects that the injected payload executes in the victim browser's security principal rather than the WordPress application's, enabling session token theft and potential privilege escalation if a privileged user views the report.

RemediationAI

An upstream fix has been committed to the WordPress Plugin SVN repository as changeset 3523211 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3523211%40bp-toolkit&new=3523211%40bp-toolkit); however, a specific released patched version number is not confirmed from available data - administrators should check the WordPress plugin repository for any version newer than 3.6.4 and update immediately if one is available. As a compensating control pending a verified patched release, site administrators should disable open user registration to prevent unauthenticated actors from obtaining subscriber accounts; note that this affects community onboarding for the BuddyPress site. Alternatively, temporarily deactivating the bp-toolkit plugin entirely eliminates the attack surface at the cost of losing all block, suspend, and report functionality. Restricting access to the WordPress admin report review screens to trusted IP ranges reduces the blast radius if a payload is already stored.