Unscored severity · published Mar 1, 2014
CVE-2014-1888
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name…
–
CVSS
2.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
Buddypress · Buddypress
through 1.9; 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.3.1; +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1888
Vendor Advisory
http://buddypress.org/2014/02/buddypress-1-9-2
osvdb.org
http://osvdb.org/103307
packetstormsecurity.com
http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html
Vendor Advisory
http://secunia.com/advisories/56950
www.securityfocus.com
http://www.securityfocus.com/archive/1/531049/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/65555
More from Buddypress
8.8
CVE-2021-21389
BuddyPress is an open source WordPress plugin to build a community site
8.5
CVE-2026-115965
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
8.5
CVE-2026-111850
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
8.1
CVE-2026-53673
BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
8.1
CVE-2024-10011
BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal