medium · CVSS v3 5.4

CVE-2026-107658

BuddyForms plugin for WordPress up to 2.10.5 is vulnerable to stored XSS via bf_post_type and buddyforms_form_content parameters. Attackers

Overview

BuddyForms plugin for WordPress up to 2.10.5 is vulnerable to stored XSS via bf_post_type and buddyforms_form_content parameters. Attackers can inject scripts that run on any user visiting the site, potentially compromising user sessions or defacing the site. The flaw requires a public form and a widgetized sidebar to deploy the payload.

Description

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customize_changeset to place a malicious Custom HTML widget into the site's front end.

Impact

Confidentiality: attackers can steal user cookies or session data. Integrity: malicious scripts can alter page content. Availability: minimal direct impact but can degrade user experience. Defenders: site administrators, WordPress users with BuddyForms plugin.

Remediation

Update BuddyForms to version 2.10.6 or later. If update not possible, disable public form submissions or remove widgetized sidebars. Sanitize input and escape output for bf_post_type and buddyforms_form_content. Use a web application firewall to block XSS payloads.

Risk context

Medium severity (CVSS 5.4). No EPSS data available. The vulnerability is exploitable by unauthenticated users, so it poses a moderate risk to sites with public forms and widgetized sidebars.

Affected products

  • BuddyForms 2.10.5
  • BuddyForms <=2.10.5

Scores

Severity
medium
CVSS v2
4
CVSS v3
5.4
CVSS v4
—
EPSS
—

XSS WordPress BuddyForms Stored XSS Public Form Widget Web Application

← All CVEs

Related CVEs

medium

CVE-2026-123287

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

View analysis

medium

CVE-2026-84164

The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.

View analysis