CVE-2024-13858

The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in the BuddyBoss Platform plugin in version 2.8.41.

• CWE-79
• CWE-79

• https://www.buddyboss.com/platform/Product
• https://www.buddyboss.com/resources/buddyboss-platform-releases/2-8-51/
• https://www.buddyboss.com/resources/buddyboss-theme-releases/2-8-50/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5f50e293-aebd-44dd-a692-64dea8f6622f?source=cveThird Party Advisory

Published

May 2, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13852The Option Editor plugin for WordPress is vulnerable to Cros…8.8
• CVE-2024-13853The SEO Tools WordPress plugin through 4.0.7 does not saniti…6.1
• CVE-2024-13854The Education Addon for Elementor plugin for WordPress is vu…4.3
• CVE-2024-13855The Prime Addons for Elementor plugin for WordPress is vulne…4.3
• CVE-2024-13856The Your Friendly Drag and Drop Page Builder — Make Builder …6.4
• CVE-2024-13857The WPGet API – Connect to any external REST API plugin for …5.5
• CVE-2024-13859The Buddyboss Platform plugin for WordPress is vulnerable to…5.4
• CVE-2024-1386The MailerLite – Signup forms (official) plugin for WordPres…6.4
• CVE-2024-13860The Buddyboss Platform plugin for WordPress is vulnerable to…5.4
• CVE-2024-13861A code injection vulnerability in the Debian package compone…7.8
• CVE-2024-13862The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Fu…7.1
• CVE-2024-13863The Stylish Google Sheet Reader 4.0 WordPress plugin before…7.1