CVE-2014-1888

Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.6.3:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.5:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.6:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.7:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.6.5:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.6.4:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.3.1:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.5.7:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.6:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.7.2:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.7.3:*:*:*:*:*:*:*
cpe:2.3:a:buddypress:buddypress:1.8:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*

Information

Published : 2014-02-28 16:01

Updated : 2018-10-30 09:27


NVD link : CVE-2014-1888

Mitre link : CVE-2014-1888


JSON object : View

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

dedicated server usa

Products Affected

buddypress

  • buddypress

wordpress

  • wordpress