PT-2026-56730 · Buddypress · Block

Nabil Irawan · CVE-2026-4653 · Published 2026-07-09 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Block, Suspend, Report for BuddyPress versions prior to 3.6.5

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the link parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update to a version newer than 3.6.4. Avoid using the link parameter until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4653

Affected Products

Block

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4653 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/01cd05c3-9629-4da4-ae9d-f99003253b95?source=cve · Note
• https://t.me/CVEtracker/59472 · Telegram Post
• https://plugins.trac.wordpress.org/browser/bp-toolkit/tags/3.6.4/includes/class-bp-toolkit-report.php#L260 · Note
• https://plugins.trac.wordpress.org/browser/bp-toolkit/trunk/admin/partials/report-cpt-main-metabox.php#L115 · Note
• https://plugins.trac.wordpress.org/browser/bp-toolkit/trunk/includes/class-bp-toolkit-report.php#L260 · Note
• https://plugins.trac.wordpress.org/browser/bp-toolkit/tags/3.6.4/admin/partials/report-cpt-main-metabox.php#L115 · Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3523211%40bp-toolkit&new=3523211%40bp-toolkit · Note
• https://t.me/cveNotify/193204 · Telegram Post