Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2020-37233 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers like onload that execute when administrators or privileged users preview or view the affected page content, enabling session hijacking and persistent phishing attacks.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.7 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CNA: [email protected]CVSS-B:6.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://wordpress.org/plugins/buddypress/	[email protected]	ProductVendor
https://www.exploit-db.com/exploits/49061	[email protected]	Exploit
https://www.vulncheck.com/advisories/wordpress-plugin-buddypress-persistent-cross-site-scripting	[email protected]	AdvisoryExploit

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

Product	Versions
BuddyPress	<= 6.2.0 (semver)
CPE cpe:2.3:a:buddypress:buddypress::::::wordpress::* Remediation Upgrade: 14.4.0moderate efforthttps://downloads.wordpress.org/plugin/buddypress.14.4.0.zip

Change History

3 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
May 16, 2026	New CVE Received	[email protected]