BuddyBoss Platform EUVD-2026-114702

Requires an authenticated account at Subscriber level or above (PR:L), and the BuddyBoss 'Enable social group creation by all members' setting must be enabled - this is the default, which permits Subscriber-level users to create groups and supply a malicious Group Name. Exploitation is explicitly not possible if group creation is restricted to administrators, so sites that have changed this setting are not exposed. The payload executes when any user subsequently accesses the injected group page; the primary limiting factors are the need for a (low-privilege) authenticated account and the default-on but reconfigurable group-creation setting.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) whose real-world priority sits below critical but above negligible. The CVSS vector indicates network-reachable, low-complexity injection requiring only low privileges (PR:L = authenticated Subscriber), with a changed scope reflecting script execution in victims' browsers and limited confidentiality/integrity impact. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not an emergency. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no signal of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis.' The dominant limiting factor is the required configuration: exploitation depends on the 'Enable social group creation by all members' setting, which is default-enabled and lets Subscriber-level users create groups - so default installs are exposed, but environments that restrict group creation to administrators are not. On balance this is a real but non-urgent issue: the low privilege barrier and default-enabled precondition make it practically reachable on typical sites, while the limited impact (stored XSS, no availability impact) and absence of exploitation signals keep it out of drop-everything territory.

An attacker registers or already holds a Subscriber-level account on a BuddyBoss-powered community site where member group creation is enabled (the default). They create a group whose name contains a malicious script payload; because the name is insufficiently sanitized and not escaped on output, the script executes in the browser of any user who views the injected group page, potentially enabling session/cookie theft or actions in the context of higher-privileged viewers. No public exploit code is identified in the provided sources.